Hardware software contracts help prevent side channel attacks
Foundations of Hardware-Software Leakage Contracts
Cryptography and SecurityHardware Architecture
Summary
Modern processors have optimizations like caches and speculative execution that can accidentally leak secret information through side channels, causing security problems. The usual hardware-software interface, called an ISA, hides these micro-level details, making it hard for programmers to write secure code. The authors discuss a new idea called hardware-software leakage contracts, which describe how much information might leak at the ISA level. This helps software developers write code that avoids these leaks without needing expert knowledge of hardware internals and guides hardware designers to avoid unexpected leaks.
What this means in practice
- •For software developers: Write programs that resist side-channel attacks without detailed knowledge of hardware internals.
- •For hardware designers: Ensure hardware features comply with leakage contracts to avoid unintended side-channel vulnerabilities.
A position paper. It proposes an approach and reports no results.
Authors
Jan Reineke
Abstract
Microarchitectural attacks such as Spectre and Meltdown undermine security by exploiting software-visible side effects of microarchitectural optimizations like caches and speculative execution. To use modern hardware securely, programmers must take into account the security implications of these optimizations. Yet instruction set architectures (ISAs)---the conventional abstraction layer between hardware and software---are ill-suited for secure programming: by design, they abstract from microarchitectural details and therefore fail to reflect their security consequences. A new security abstraction is emerging to fill this void: hardware-software leakage contracts. To support the principled development of secure software on modern hardware such contracts characterize side-channel leakage at the ISA level. Thereby they enable programmers and compilers to generate code that is provably resistant to side-channel attacks---without having to explicitly reason about the microarchitecture. On the other hand, they provide a specification for hardware designers to ensure that microarchitectures do not introduce unintended and undocumented side channels. This paper introduces the foundations of this emerging topic, discussing recent contributions and unresolved challenges along the way.