Adaptive Compiler Strategies for Mitigating Timing Side Channel Attacks

Cleemput, Jeroen Van; Sutter, Bjorn De; Bosschere, Koen De

doi:10.1109/tdsc.2017.2729549

Cited by 18 publications

(11 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Lipp et al [61] showed cache attacks and cache template attacks on ARM. Van Cleemput et al [101] proposed using information gathered in the templating phase to detect and mitigate side channels. Wang used symbolic execution and constraint solvers to speed up cache templating of cryptographic software [108].…”

Section: E Automated Discovery Of Side Channel Attacksmentioning

confidence: 99%

“…Section II-B), data deduplication (e.g., of strings) during compilation is not widely known and its security implications are entirely unexplored. The security of constant-time implementations has been analyzed for side channels being introduced by compilers [74], [101], [94], [11]. In this section, we first show that dead-stripping (cf.…”

Section: Compiler-and Linker-introduced Spatial Distance In Binariesmentioning

confidence: 99%

See 1 more Smart Citation

Layered Binary Templating: Efficient Detection of Compiler- and Linker-introduced Leakage

Schwarzl¹,

Kraft²,

Gruss³

2022

Preprint

View full text Add to dashboard Cite

Cache template attacks demonstrated automated leakage of user input in shared libraries. However, for large binaries, the runtime is prohibitively high. Other automated approaches focused on cryptographic implementations and media software but are not directly applicable to user input. Hence, discovering and eliminating all user input side-channel leakage on a cache-line granularity within huge code bases are impractical.In this paper, we present a new generic cache template attack technique, LBTA, layered binary templating attacks. LBTA uses multiple coarser-grained side channel layers as an extension to cache-line granularity templating to speed up the runtime of cache templating attacks. We describe LBTA with a variable number of layers with concrete side channels of different granularity, ranging from 64 B to 2 MB in practice and in theory beyond. In particular the software-level page cache side channel in combination with the hardware-level L3 cache side channel, already reduces the templating runtime by three orders of magnitude. We apply LBTAs to different software projects and thereby discover data deduplication and dead-stripping during compilation and linking as novel security issues. We show that these mechanisms introduce large spatial distances in binaries for data accessed during a keystroke, enabling reliable leakage of keystrokes. Using LBTA on Chromium-based applications, we can build a full unprivileged cache-based keylogger 1 . Our findings show that all user input to Chromium-based apps is affected and we demonstrate this on a selection of popular apps including Signal, Threema, Discord, and password manager apps like passky. As this is not a flaw of individual apps but the framework, we conclude that all apps that use the framework will also be affected, i.e., hundreds of apps.

show abstract

Section: E Automated Discovery Of Side Channel Attacksmentioning

confidence: 99%

Section: Compiler-and Linker-introduced Spatial Distance In Binariesmentioning

confidence: 99%

Layered Binary Templating: Efficient Detection of Compiler- and Linker-introduced Leakage

Schwarzl¹,

Kraft²,

Gruss³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…(5) The computer is used to receive electromagnetic leakage traces and responsible for data storage, communication and further analysis. (6) This process is repeated many times until the electromagnetic leakage trace requirement is met.…”

Section: Experimental Platformmentioning

confidence: 99%

“…Sensitive user information can be recovered from the acoustic side-channel of keyboard in [5]. Numerous types of side-channels have been successfully exploited to reveal secret information in previous years, such as time [6], power consumption [7], electromagnetic emission [8,9], optical signal [10] or acoustic emanation [11].…”

Section: Introductionmentioning

confidence: 99%

Analysis of Electromagnetic Information Leakage Based on Cryptographic Integrated Circuits

Sun

Cui

et al. 2021

Entropy

View full text Add to dashboard Cite

Cryptographic algorithm is the most commonly used method of information security protection for many devices. The secret key of cryptographic algorithm is usually stored in these devices’ registers. In this paper, we propose an electromagnetic information leakage model to investigate the relationship between the electromagnetic leakage signal and the secret key. The registers are considered as electric dipole models to illustrate the source of the electromagnetic leakage. The equivalent circuit of the magnetic field probe is developed to bridge the output voltage and the electromagnetic leakage signal. Combining them, the electromagnetic information leakage model’s function relationship can be established. Besides, an electromagnetic leakage model based on multiple linear regression is proposed to recover the secret key and the model’s effectiveness is evaluated by guess entropy. Near field tests are conducted in an unshielded ordinary indoor environment to investigate the electromagnetic side-channel information leakage. The experiment result shows the correctness of the proposed electromagnetic leakage model and it can be used to recover the secret key of the cryptographic algorithm.

show abstract

“…In work complementary to ours, Cleemput et al [28] propose leveraging the profiling information used in dynamic compilation to mitigate timing side channels. Starting from a developer-chosen root method, profiling information on the number of back edges taken or method invocations is collected for values in a training input set.…”

Section: Related Workmentioning

confidence: 99%

JIT Leaks: Inducing Timing Side Channels through Just-In-Time Compilation

Brennan

Rosner

Bultan

2020

2020 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Side-channel vulnerabilities in software are caused by an observable imbalance in resource usage across different program paths. We show that just-in-time (JIT) compilation, which is crucial to the runtime performance of modern interpreted languages, can introduce timing side channels in cases where the input distribution to the program is non-uniform. Such timing channels can enable an attacker to infer potentially sensitive information about predicates on the program input.We define three attack models under which such side channels are harnessable and five vulnerability templates to detect susceptible code fragments and predicates. We also propose profiling algorithms to generate the representative statistical information necessary for the attacker to perform accurate inference.We systematically evaluate the strength of these JIT-based side channels on the java.lang.String, java.lang.Math, and java.math.BigInteger classes from the Java standard library, and on the JavaScript built-in objects String, Math, and Array. We carry out our evaluation using two widely adopted, open-source, JIT-enhanced runtime engines for the Java and JavaScript languages: the Oracle HotSpot Java Virtual Machine and the Google V8 JavaScript engine, respectively.Finally, we demonstrate a few examples of JIT-based side channels in the Apache Shiro security framework and the GraphHopper route planning server, and show that they are observable over the public Internet.

show abstract

Adaptive Compiler Strategies for Mitigating Timing Side Channel Attacks

Cited by 18 publications

References 44 publications

Layered Binary Templating: Efficient Detection of Compiler- and Linker-introduced Leakage

Layered Binary Templating: Efficient Detection of Compiler- and Linker-introduced Leakage

Analysis of Electromagnetic Information Leakage Based on Cryptographic Integrated Circuits

JIT Leaks: Inducing Timing Side Channels through Just-In-Time Compilation

Contact Info

Product

Resources

About