Looking at libc sources, apple and openbsd implementations match our naive fallback. Only FreeBSD (and only x86_64) seems to implement an optimized version.
It’s not worth the hassle of using a platform-specific function for such little gain.
Additionally, as mentioned below, this is the only case outside of sha2 that requires an autoconf check, and I have upcoming PRs to remove the sha2 ones.
Apple’s impl is unoptimized.
As-is OpenBSD’s impl.
Relevant IRC conversation with sipa:
<cfields> sipa: chacha20poly1305.cpp uses libc’s timingsafe_bcmp when possible. But looking around at apple/freebsd/openbsd, I don’t see any impl that doesn’t use the naive implementation that matches our fallback… <cfields> is there any reason to belive there’s an optimized impl somewhere that we’re actually hitting? <cfields> asking because after cleaning up sha2, timingsafe_bcmp is the last autoconf check that remains in all of crypto. It’d make life easy if we could just always use our internal one. <cfields> *all of crypto/ <sipa> cfields: let’s get rid of the dependency then <sipa> it’s a trivial function <sipa> and if we need it for some platforms, no real reason not to use it on all
After the above discusstion, I did end up finding the x86_64-optimized FreeBSD impl, but I don’t think that’s all that significant.
