More to the point, often you need assembly to prevent the compiler from sabotaging your carefully constant-time algorithms, replacing your careful length-indepe

More to the point, often you need assembly to prevent the compiler from sabotaging your carefully constant-time algorithms, replacing your careful length-independent XOR loops with branches and the like. Performance is a small part of why crypto code is often written in assembly. C is simply too high level, allowing too many optimizations. For that matter, assembly is too high level, and Intel is adding flags to turn off some of the internal CPU optimizations: https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/data-operand-independent-timing-isa-guidance.html https://www.intel.com/content/www/us/en/developer/articles/t...