Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code

article Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code published Santiago Arranz-Olmos author Gilles Barthe author Benjamin Grégoire author Jan Jancar author Vincent Laporte author Tiago Oliveira author Peter Schwabe author It is a widely accepted standard practice to implement cryptographic software so that secret inputs do not influence the cycle count. Software following this paradigm is often referred to as “constant-time” software and typically involves following three rules: 1) never branch on a secret-dependent condition, 2) never access memory at a secret-dependent location, and 3) avoid variable-time arithmetic operations on secret data. The third rule requires knowledge about such variable-time arithmetic instructions, or vice versa, which operations are safe to use on secret inputs. For a long time, this knowledge was based on either documentation or microbenchmarks, but critically, there were never any guarantees for future microarchitectures. This changed with the introduction of the data-operand-independent-timing (DOIT) mode on Intel CPUs and, to some extent, the data-independent-timing (DIT) mode on Arm CPUs. Both Intel and Arm document a subset of their respective instruction sets that are intended to leak no information about their inputs through timing, even on future microarchitectures if the CPU is set to run in a dedicated DOIT (or DIT) mode.In this paper, we present a principled solution that leverages DOIT to enable cryptographic software that is future-proof constant-time, in the sense that it ensures that only instructions from the DOIT subset are used to operate on secret data, even during speculative execution after a mispredicted branch or function return location. For this solution, we build on top of existing security type systems in the Jasmin framework for high-assurance cryptography.We then use our solution to evaluate the extent to which existing cryptographic software built to be “constant-time” is already secure in this stricter paradigm implied by DOIT and what the performance impact is to move from constant-time to future-proof constant-time. Universitatsbibliothek der Ruhr-Universitat Bochum2025 IACR Transactions on Cryptographic Hardware and Embedded Systems 2569-292510.46586/tches.v2025.i3.644-667 20253644-667 S. Arranz-Olmos et al., “Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code,” IACR Transactions on Cryptographic Hardware and Embedded Systems, vol. 2025, no. 3, pp. 644–667, 2025, doi: <a href="https://doi.org/10.46586/tches.v2025.i3.644-667">10.46586/tches.v2025.i3.644-667</a>. Arranz-Olmos, Santiago, Gilles Barthe, Benjamin Grégoire, Jan Jancar, Vincent Laporte, Tiago Oliveira, and Peter Schwabe. “Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code.” IACR Transactions on Cryptographic Hardware and Embedded Systems 2025, no. 3 (2025): 644–67. <a href="https://doi.org/10.46586/tches.v2025.i3.644-667">https://doi.org/10.46586/tches.v2025.i3.644-667</a>. Arranz-Olmos S, Barthe G, Grégoire B, et al. Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code. IACR Transactions on Cryptographic Hardware and Embedded Systems. 2025;2025(3):644-667. doi:<a href="https://doi.org/10.46586/tches.v2025.i3.644-667">10.46586/tches.v2025.i3.644-667</a> @article{Arranz-Olmos_Barthe_Grégoire_Jancar_Laporte_Oliveira_Schwabe_2025, title={Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code}, volume={2025}, DOI={<a href="https://doi.org/10.46586/tches.v2025.i3.644-667">10.46586/tches.v2025.i3.644-667</a>}, number={3}, journal={IACR Transactions on Cryptographic Hardware and Embedded Systems}, publisher={Universitatsbibliothek der Ruhr-Universitat Bochum}, author={Arranz-Olmos, Santiago and Barthe, Gilles and Grégoire, Benjamin and Jancar, Jan and Laporte, Vincent and Oliveira, Tiago and Schwabe, Peter}, year={2025}, pages={644–667} } S. Arranz-Olmos, G. Barthe, B. Grégoire, J. Jancar, V. Laporte, T. Oliveira, P. Schwabe, IACR Transactions on Cryptographic Hardware and Embedded Systems 2025 (2025) 644–667. Arranz-Olmos, Santiago, et al. “Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code.” IACR Transactions on Cryptographic Hardware and Embedded Systems, vol. 2025, no. 3, Universitatsbibliothek der Ruhr-Universitat Bochum, 2025, pp. 644–67, doi:<a href="https://doi.org/10.46586/tches.v2025.i3.644-667">10.46586/tches.v2025.i3.644-667</a>. Arranz-Olmos, S., Barthe, G., Grégoire, B., Jancar, J., Laporte, V., Oliveira, T., & Schwabe, P. (2025). Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2025(3), 644–667. <a href="https://doi.org/10.46586/tches.v2025.i3.644-667">https://doi.org/10.46586/tches.v2025.i3.644-667</a> 655372026-04-30T09:31:53Z2026-04-30T09:32:27Z