Practical Mitigations for Timing-Based Side-Channel Attacks on Modern x86 Processors

Abstract

This paper studies and evaluates the extent to which automated compiler techniques can defend against timing-based side-channel attacks on modern x86 processors. We study how modern x86 processors can leak timing information through sidechannels that relate to control flow and data flow. To eliminate key-dependent control flow and key-dependent timing behavior related to control flow, we propose the use of if-conversion in a compiler backend, and evaluate a proof-of-concept prototype implementation. Furthermore, we demonstrate two ways in which programs that lack key-dependent control flow and keydependent cache behavior can still leak timing information on modern x86 implementations such as the Intel Core 2 Duo, and propose defense mechanisms against them.

A Provably Secure and Efficient Countermeasure against Timing Attacks

“…By contrast, our approach only requires that the system's execution time be a function of the inputs to the system. Code transformations to eliminate the influence of secrets on the control flow of a program have been proposed in [25], [8], and they have been applied to eliminate timing leaks in code for modern multi-purpose processors. As shown in [25], the resulting performance overhead can be large compared to that introduced by blinding (and hence to that introduced by our countermeasure).…”

On Subnormal Floating Point and Abnormal Timing

“…If the type system rejects a program because it has "uneven" branches, the program can still be transformed, for example by adding suitable "padding" instructions along shorter branches [2,9,10,28], by using "conditional execution" implemented via bit-masking and ternary choice [39] or by using if-conversion [15]. All of the above approaches are limited to situations where the instruction count is a proxy for actual performance, and do not protect against lower level, e.g., instruction cache attacks [1] or the data timing variation attacks we demonstrated.…”

Manger’s Attack Revisited

“…Furthermore, based on the conditional branching, the attack can in principle be mounted as a branch prediction attack [7]. Basically, it is easily possible to remove this vulnerability by using branch free code employing the techniques shown in [8,9]. But since implementing the countermeasure proposed by us in Sec.…”

“…In order to achieve the goal of secret independent running time, we have to avoid secret based branching in the routine. To this end, techniques similar to those proposed in [8,9] should be used. Those techniques are based on replacing conditional statements with logical masking.…”