Eliminating timing side-channel leaks using program repair

Abstract

We propose a method, based on program analysis and transformation, for eliminating timing side channels in software code that implements security-critical applications. Our method takes as input the original program together with a list of secret variables (e.g., cryptographic keys, security tokens, or passwords) and returns the transformed program as output. The transformed program is guaranteed to be functionally equivalent to the original program and free of both instruction-and cache-timing side channels. Specifically, we ensure that the number of CPU cycles taken to execute any path is independent of the secret data, and the cache behavior of memory accesses, in terms of hits and misses, is independent of the secret data. We have implemented our method in LLVM and validated its effectiveness on a large set of applications, which are cryptographic libraries with 19,708 lines of C/C++ code in total. Our experiments show the method is both scalable for real applications and effective in eliminating timing side channels. CCS CONCEPTS• Security and privacy → Cryptanalysis and other attacks; • Software and its engineering → Compilers; Formal software verification; KEYWORDSSide-channel attack, countermeasure, cache, timing, static analysis, abstract interpretation, program synthesis, program repair ACM Reference Format:

Abstract interpretation under speculative execution

“…We have implemented our method in LLVM [33] and experimentally compared it with a state-of-the-art, non-speculative static cache analysis technique [62]. In our experiments, we used a set-associative cache with the LRU replacement policy, 512 cache lines, and 64 bytes per line.…”

“…As a result, for some key values, accessing sbox results in a cache hit, but for other key values, it results in a cache miss. Although timing side channels have been investigated before [7,16,25,62], these prior works never considered speculative execution. Our contribution, in this context, is to show that even if a program is leak-free under normal execution, it may still be leaky under speculative execution.…”

“…We first compare our method with the state-of-the-art, nonspeculative method [62]. The results are shown in Table 5.…”

“…Ferdinand and Wilhelm [18,20] pioneered the use of abstract interpretation in may-and must-hit cache analyses [61]. Others also used similar techniques to detect timing side channels [7,16,62]. However, prior works focused primarily on improving abstract interpretation without considering speculative execution.…”

“…This is important because an instruction may take only 1-3 clock cycles when there is a cache hit, but tens or even hundreds of clock cycles when there is a cache miss. Static analysis is useful in examining the cache related properties of a program, e.g., to detect information leaks through timing side channels [7,16,30,53,62] or prove that a computation task always meets the deadline [18,20].…”