Verifying Constant-Time Implementations by Abstract Interpretation - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2017

Verifying Constant-Time Implementations by Abstract Interpretation

Alix Trieu

Abstract

Constant-time programming is an established discipline to secure programs against timing attacks. Several real-world secure C libraries such as NaCl, mbedTLS, or Open Quantum Safe, follow this discipline. We propose an advanced static analysis, based on state-of-the-art techniques from abstract interpretation, to report time leakage during programming. To that purpose, we analyze source C programs and use full context-sensitive and arithmetic-aware alias analyses to track the tainted flows. We give semantic evidences of the correctness of our approach on a core language. We also present a prototype implementation for C programs that is based on the CompCert compiler toolchain and its companion Verasco static analyzer. We present verification results on various real-world constant-time programs and report on a successful verification of a challenging SHA-256 implementation that was out of scope of previous tool-assisted approaches.
Fichier principal
Vignette du fichier
esorics17.pdf (994 Ko) Télécharger le fichier
Origin Files produced by the author(s)
Loading...

Dates and versions

hal-01588444 , version 1 (15-09-2017)

Identifiers

  • HAL Id : hal-01588444 , version 1

Cite

Sandrine Blazy, David Pichardie, Alix Trieu. Verifying Constant-Time Implementations by Abstract Interpretation. European Symposium on Research in Computer Security, Sep 2017, Oslo, Norway. ⟨hal-01588444⟩
770 View
797 Download

Share

Gmail Mastodon Facebook X LinkedIn More