I replied on the LLVM thread which I'll quote here: I think it would be great to have first-class support for something like this in LLVM. It has become commonplace for new cryptographic specifications to use a pseudocode “CMOV”-like function to describe where to apply this sort of predication. Achieving this sort of constant-time predication is something we currently implement today in RustCrypto in the cmov crate, which uses asm! to avoid e.g. LLVM rewriting CMOV* instructions as branch...
