Compiler pipeline helps protect devices from timing attacks
FreeSBee: A Constant-Time Compilation Pipeline
Cryptography and Security
Summary
Timing attacks can let hackers learn secret information by measuring how long a device takes to run certain code. The authors present a method that analyzes which parts of the program use sensitive data and then changes the program's code inside the compiler to hide timing differences. They tested their approach on realistic hardware and found it made timing attacks much harder, even if it didn’t perfectly equalize every cycle. This work makes it easier to produce safer software for small devices like those in the Internet of Things.
What this means in practice
- •For embedded software developers: Create programs for IoT devices that are resistant to timing attacks by automatically modifying sensitive code paths during compilation.
- •For security engineering teams: Integrate a compiler-based workflow to harden code against timing side-channels in security-sensitive embedded applications.
Authors
Julian Ganz, David Knothe, David Oswald, Sebastian Reiter, Thorben Schneider, Simon Wegener
Abstract
Constant-time execution is an important security property, especially for IoT devices, that prevents the leakage of sensitive information over timing side-channels. However, achieving constant-time execution is very hard when going down to the cycle level, at least on realistic devices. A lot of research is concerned with producing tools that either determine whether code is constant-time or that ensure it is compiled into a constant-time binary, with various degrees of accuracy. In this work, we present and evaluate a full workflow for hardening against timing side-channels during compilation. It starts with taint analysis to determine the code locations that depend on sensitive information. These are then the object of automated control-flow transformations inside the compiler to seal possible timing side-channels. We evaluate our workflow in detail on a realistic application running on a RISC-V core using both static timing analysis and statistical methods. Even though we do not reach cycle-accurate constant-time execution, our statistical results suggest that our hardened binary is safe against timing attacks.