  Speculative execution attacks undermine the security of constant-time
programming, the standard technique used to prevent microarchitectural side
channels in security-sensitive software such as cryptographic code.
Constant-time code must therefore also deploy a defense against speculative
execution attacks to prevent leakage of secret data stored in memory or the
processor registers. Unfortunately, contemporary defenses, such as speculative
load hardening (SLH), can only satisfy this strong security guarantee at a very
high performance cost.
  This paper proposes DECLASSIFLOW, a static program analysis and protection
framework to efficiently protect constant-time code from speculative leakage.
DECLASSIFLOW models "attacker knowledge" -- data which is inherently
transmitted (or, implicitly declassified) by the code's non-speculative
execution -- and statically removes protection on such data from points in the
program where it is already guaranteed to leak non-speculatively. Overall,
DECLASSIFLOW ensures that data which never leaks during the non-speculative
execution does not leak during speculative execution, but with lower overhead
than conservative protections like SLH.
