Fun with flags: How Compilers Break and Fix Constant-Time Code

Comments, chapters, ... Slides Search
Loading Click here to add:
Subscribe to notifications

When subscribed to notifications, an email will be sent to you for all added annotations.

Your user account has no email address.

Information on this media

14 views

You meticulously craft constant-time code to protect against side-channel attacks—only to have your compiler silently sabotage it. Optimization passes, designed to make code faster, can introduce timing leaks, violating security guarantees in ways developers never intended. But which optimizations are responsible? And how can you stop them without rewriting the compiler itself? In this talk, we investigate the mystery behind compiler-induced constant-time violations. We analyze real-world examples from GCC and LLVM, exposing how specific optimizations betray security assumptions. More importantly, we provide practical solutions: which compiler flags can mitigate these leaks, and what is the real cost of securing your compiled code? Your compiler may not be your friend—but with the right knowledge, you can stop it from turning against you.

Creation date: July 3, 2025
Speakers: Antoine Geimer
License: CC BY-SA v4
Links:

Other media in the channel "2025"