FaCT is an open source programming language created in 2017 by Deian Stefan.

FaCT is a domain-specific language that aids you in writing constant-time code for cryptographic routines that need to be free from timing side channels. This is the compiler for the Flexible and Constant Time cryptographic programming language. Real-world cryptographic code is often written in a subset of C intended to execute in constant-time, thereby avoiding timing side channel vulnerabilities. This C subset eschews structured programming as we know it: if-statements, looping constructs, and procedural abstractions can leak timing information when handling sensitive data. The resulting obfuscation has led to subtle bugs, even in widely-used high-profile libraries like OpenSSL. To address the challenge of writing constant-time cryptographic code, we present FaCT, a crypto DSL that provides high-level but safe language constructs. The FaCT compiler uses a secrecy type system to automatically transform potentially timing-sensitive high-level code into low-level, constant-time LLVM bitcode. We develop the language and type system, formalize the constant-time transformation, and present an empirical evaluation that uses FaCT to implement core crypto routines from several open-source projects including OpenSSL, libsodium, and curve25519-donna. Our evaluation shows that FaCT's design makes it possible to write \emph{readable}, high-level cryptographic code, with \emph{efficient}, \emph{constant-time} behavior.

• FaCT is developed on GitHub and has 92 stars
• FaCT first developed in University of California San Diego and Stanford University and PI for Security and Privacy and Inria Sophia Antipolis and IMDEA Software Institute
• Read more about FaCT on the web: 1.