Abstract:The implementations of most hardened cryptographic libraries use defensive programming techniques for side-channel resistance. These techniques are usually specified as guidelines to developers on specific code patterns to use or avoid. Examples include performing arithmetic operations to choose between two variables instead of executing a secret-dependent branch. However, such techniques are only meaningful if they persist across compilation. In this paper, we investigate how optimizations used by modern compilers break the protections introduced by defensive programming techniques. Specifically, how compilers break high-level constant-time implementations used to mitigate timing side-channel attacks. We run a large-scale experiment to see if such compiler-induced issues manifest in state-of-the-art cryptographic libraries. We develop a tool that can profile virtually any architecture, and we use it to run trace-based dynamic analysis on 44,604 different targets. Particularly, we focus on the most widely deployed cryptographic libraries, which aim to provide side-channel resistance. We are able to evaluate whether their claims hold across various CPU architectures, including x86-64, x86-i386, armv7, aarch64, RISC-V, and MIPS-32. Our large-scale study reveals that several compiler-induced secret-dependent operations occur within some of the most highly regarded hardened cryptographic libraries. To the best of our knowledge, such findings represent the first time these issues have been observed in the wild. One of the key takeaways of this paper is that the state-of-the-art defensive programming techniques employed for side-channel resistance are still inadequate, incomplete, and bound to fail when paired with the optimizations that compilers continuously introduce.

DEJITLEAK: Eliminating JIT-Induced Timing Side-Channel Leaks

Preventing Timing Side-Channels via Security-Aware Just-In-Time Compilation

Eliminating Timing Side-Channel Leaks using Program Repair

Mitigating Power Side Channels during Compilation

Dynamic Supply Noise Aware Timing Analysis with JIT Machine Learning Integration

Java JIT Testing with Template Extraction

Compiling Java just in time

Breaking Bad: How Compilers Break Constant-Time~Implementations

JITScope: Protecting Web Users from Control-Flow Hijacking Attacks

MicroWalk: A Framework for Finding Side Channels in Binaries

Indirect Meltdown: Building Novel Side-Channel Attacks from Transient-Execution Attacks

RIM: A Method to Defend from JIT Spraying Attack

DECLASSIFLOW: A Static Analysis for Modeling Non-Speculative Knowledge to Relax Speculative Execution Security Measures (Full Version)

Interface-Based Side Channel in TEE-Assisted Networked Services

Automatically Eliminating Speculative Leaks from Cryptographic Code with Blade

Validating JIT Compilers via Compilation Space Exploration

JIT-spraying prevention mechanism based on instruction padding randomization

Towards Efficient Verification of Constant-Time Cryptographic Implementations

Ozone: Efficient Execution with Zero Timing Leakage for Modern Microarchitectures

Timing Side-Channel Mitigation via Automated Program Repair

Quantifying Dynamic Leakage: Complexity Analysis and Model Counting-based Calculation