On 2025-12-09 20:51, Bjorn Reese via Std-Proposals wrote:
> On 12/9/25 09:07, Shivam Kunwar via Std-Proposals wrote:
>
>> The Problem :
>>
>> Cryptographic code needs to perform conditional selection without
>> leaking timing information. The standard pattern looks like this
>>
>> // Intended to be constant-time
>> uint64_t mask = -(uint64_t)(!!cond);
>> result = (a & mask) | (b & ~mask);
>
> Notice that SIMD works this way.
>
>> template<class T>
>> constexpr T select_explicit(bool test, T a, T b) noexcept;
>
> It may be beneficial to explore the direction taken in the std::simd
> proposal, which has an exposition-only conditional function because
> the conditional operator cannot be overloaded:
>
> https://eel.is/c%2B%2Bdraft/simd.nonmembers#simd.cond
>
> There is also a proposal to make the conditional operator overloadable:
>
> https://wg21.link/P0917
>
> This does not, however, solve the problem of optimizers favouring
> conditional instructions.

Thanks for mentioning this, select_explicit function is essentially the
scalar equivalent of std::simd's masked operations.

and well that suggests a nice alignment that select_explicit(cond, a, b)
for scalars parallels how simd::conditional works for vectors, And if
the conditional operator overloadable makes to the standard, then there
might even a path to unified syntax.