Secret Types Require OS-Backed Secrecy Code Sections

Mitigating side-channel vulnerabilities in software is becoming increasingly difficult. The current state of the art in side-channel resistance is speculative constant-time compliance. However, real-world compilers do not yet provide sufficient means to achieve this. Research has mostly focused on preserving this property during compilation, and on type-level secrecy to automatically generate compliant machine code. Meanwhile, recent developments in processors, such as data-dependent prefetchers, continue to introduce secret-dependent behavior independent of the algorithm. Unlike most previous side-channels, environmental mitigations temporarily disable some of these features.