Constantine: Automatic Side-Channel Resistance Using Efficient Control and Data Flow Linearization

Abstract

In the era of microarchitectural side channels, vendors scramble to deploy mitigations for transient execution attacks, but leave traditional side-channel attacks against sensitive software (e.g., crypto programs) to be fixed by developers by means of constant-time programming (i.e., absence of secret-dependent code/data patterns). Unfortunately, writing constant-time code by hand is hard, as evidenced by the many flaws discovered in production side channelresistant code. Prior efforts to automatically transform programs into constant-time equivalents offer limited security or compatibility guarantees, hindering their applicability to real-world software.In this paper, we present Constantine, a compiler-based system to automatically harden programs against microarchitectural side channels. Constantine pursues a radical design point where secretdependent control and data flows are completely linearized (i.e., all involved code/data accesses are always executed). This strategy provides strong security and compatibility guarantees by construction, but its natural implementation leads to state explosion in real-world programs. To address this challenge, Constantine relies on carefully designed optimizations such as just-in-time loop linearization and aggressive function cloning for fully context-sensitive points-to analysis, which not only address state explosion, but also lead to an efficient and compatible solution. Constantine yields overheads as low as 16% on standard benchmarks and can handle a fully-fledged component from the production wolfSSL library. CCS CONCEPTS• Security and privacy → Side-channel analysis and countermeasures; • Software and its engineering → Compilers.

Binsec/Rel: Symbolic Binary Analyzer for Security with Applications to Constant-Time and Secret-Erasure

“…• Finally, this study shows that the preservation of constant-time by compilers depends on multiple factors and cannot simply rely on enabling/disabling optimizations. Instead, compiler-based hardening [82,83] or property preservation [15] seem promising directions, in which Binsec/Rel could be used for validation. Experiments are performed on the programs introduced in Section 6.1 for bug-finding and bounded-verification (338 samples, 70k instructions).…”

“…Aside from a posteriori analysis, correct-by-design approaches [106,107,108,13] require to reimplement cryptographic primitives from scratch. Program transformations have been proposed to automatically transform insecure programs into (variations of) constant-time programs [109,103,104,110,111,23,112,83,111,82,113]. In particular, Raccoon and Constantine consider a constant-time leakage model and seem promising, however they operate at LLVM level and do not protect against violations introduced by backend compiler passes.…”

“They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks

“…We do not claim our list to be comprehensive, especially in this currently active field of research. In particular, we did not ask about Constantine [54], Pitchfork-angr [55], Cachefix [56], and ENCoVer [57], just to name a few.…”

Layered Binary Templating: Efficient Detection of Compiler- and Linker-introduced Leakage

“…Schwarzl et al [91] further optimized this approach but still observe runtime overheads of factor 1000 and more, even for comparably simple applications. Borrello et al [8] focused more on the protection of cryptographic implementations and still observe a runtime overhead of factor 3.17 to 5.07 on these relatively small examples. Hence, the problem of secret dependency on user input in large applications remains an open problem.…”

“…Due to this significant influence of compilers on sidechannel leakage in binaries, they are also frequently used for new mitigation proposals against side-channel leakage [22], [77], [76], [17], [33], [16], [8].…”