@article{65537,
  abstract     = {{<jats:p>It is a widely accepted standard practice to implement cryptographic software so that secret inputs do not influence the cycle count. Software following this paradigm is often referred to as “constant-time” software and typically involves following three rules: 1) never branch on a secret-dependent condition, 2) never access memory at a secret-dependent location, and 3) avoid variable-time arithmetic operations on secret data. The third rule requires knowledge about such variable-time arithmetic instructions, or vice versa, which operations are safe to use on secret inputs. For a long time, this knowledge was based on either documentation or microbenchmarks, but critically, there were never any guarantees for future microarchitectures. This changed with the introduction of the data-operand-independent-timing (DOIT) mode on Intel CPUs and, to some extent, the data-independent-timing (DIT) mode on Arm CPUs. Both Intel and Arm document a subset of their respective instruction sets that are intended to leak no information about their inputs through timing, even on future microarchitectures if the CPU is set to run in a dedicated DOIT (or DIT) mode.In this paper, we present a principled solution that leverages DOIT to enable cryptographic software that is future-proof constant-time, in the sense that it ensures that only instructions from the DOIT subset are used to operate on secret data, even during speculative execution after a mispredicted branch or function return location. For this solution, we build on top of existing security type systems in the Jasmin framework for high-assurance cryptography.We then use our solution to evaluate the extent to which existing cryptographic software built to be “constant-time” is already secure in this stricter paradigm implied by DOIT and what the performance impact is to move from constant-time to future-proof constant-time.</jats:p>}},
  author       = {{Arranz-Olmos, Santiago and Barthe, Gilles and Grégoire, Benjamin and Jancar, Jan and Laporte, Vincent and Oliveira, Tiago and Schwabe, Peter}},
  issn         = {{2569-2925}},
  journal      = {{IACR Transactions on Cryptographic Hardware and Embedded Systems}},
  number       = {{3}},
  pages        = {{644--667}},
  publisher    = {{Universitatsbibliothek der Ruhr-Universitat Bochum}},
  title        = {{{Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code}}},
  doi          = {{10.46586/tches.v2025.i3.644-667}},
  volume       = {{2025}},
  year         = {{2025}},
}