CT-LLVM: Automatic Large-Scale Constant-Time Analysis

Zhiyuan Zhang; Gilles Barthe

Paper 2025/338

CT-LLVM: Automatic Large-Scale Constant-Time Analysis

Zhiyuan Zhang

, Max Planck Institute for Security and Privacy

Gilles Barthe

, Max Planck Institute for Security and Privacy, IMDEA Software

Abstract

Constant-time (CT) is a popular programming discipline to protect cryptographic libraries against micro-architectural timing attacks. One appeal of the CT discipline lies in its conceptual simplicity: a program is CT iff it has no secret-dependent data-flow, control-flow or variable-timing operation. Thanks to its simplicity, the CT discipline is supported by dozens of analysis tools. However, a recent user study demonstrates that these tools are seldom used due to poor usability and maintainability (Jancar et al. IEEE SP 2022). In this paper, we introduce CT-LLVM, a CT analysis tool designed for usability, maintainability and automatic large-scale analysis. Concretely, CT-LLVM is packaged as a LLVM plugin and is built as a thin layer on top of two standard LLVM analysis: def-use and alias analysis. Besides confirming known CT violations, we demonstrate the usability and scalability of CT-LLVM by automatically analyzing nine cryptographic libraries. On average, CT-LLVM can automatically and soundly analyze 36% of the functions in these libraries, proving that 61% of them are CT. In addition, the large-scale automatic analysis also reveals new vulnerabilities in these libraries. In the end, we demonstrate that CT-LLVM helps systematically mitigate compiler-introduced CT violations, which has been a long-standing issue in CT analysis.

Metadata

Available format(s): PDF
Category: Implementation
Publication info: Preprint.
Keywords: constant-time policy side-channel analysis
Contact author(s): zhiyuan zhang @ mpi-sp org
gilles barthe @ mpi-sp org
History: 2025-02-25: approved; 2025-02-24: received; See all versions
Short URL: https://ia.cr/2025/338
License: CC BY

BibTeX

@misc{cryptoeprint:2025/338,
      author = {Zhiyuan Zhang and Gilles Barthe},
      title = {{CT}-{LLVM}: Automatic Large-Scale Constant-Time Analysis},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/338},
      year = {2025},
      url = {https://eprint.iacr.org/2025/338}
}