The following code may produce a secret-dependent branch when compiled under Clang:

The function poly_frommsg produces a polynomial based on the bits of m during both encapsulation and decapsulation. Despite the source-level mitigations in poly_frommsg, the latest generations of Clang recognize that the code essentially performs a bit test and produces a secret-dependent branch for several compiler options.

Here are a few compiler options (Clang 15-16-17-18 on x86) which produce a branch (Godbolt link):

• -Os
• -O1
• -O2 -fno-vectorize
• -O3 -fno-vectorize

Note that plain -O2 and -O3 (i.e., without fno-vectorize) produce branch and vectorized code side by side in the binary. In practice, the vectorized instructions appear to be selected for execution at runtime.

The timing leak can be used to implement a plaintext-checking oracle.

Thanks to the help of Peter Schwabe, the pqcrystals/kyber upstream already has a fix available for this issue: pq-crystals/kyber@9b8d306