  We develop a new approach for building cryptographic implementations. Our
approach goes the last mile and delivers assembly code that is provably
functionally correct, protected against side-channels, and as efficient as
hand-written assembly. We illustrate ur approach using ChaCha20-Poly1305, one
of the mandatory ciphersuites in TLS 1.3, and deliver formally verified
vectorized implementations which outperform the fastest non-verified code.
  We realize our approach by combining the Jasmin framework, which offers in a
single language features of high-level and low-level programming, and the
EasyCrypt proof assistant, which offers a versatile verification infrastructure
that supports proofs of functional correctness and equivalence checking.
Neither of these tools had been used for functional correctness before. Taken
together, these infrastructures empower programmers to develop efficient and
verified implementations by "game hopping", starting from reference
implementations that are proved functionally correct against a specification,
and gradually introducing program optimizations that are proved correct by
equivalence checking.
  We also make several contributions of independent interest, including a new
and extensible verified compiler for Jasmin, with a richer memory model and
support for vectorized instructions, and a new embedding of Jasmin in
EasyCrypt.
