arXiv 1806.024442018-06cs.CRcs.PLcs.SE

Eliminating Timing Side-Channel Leaks using Program Repair

Meng Wu, Shengjian Guo, Patrick Schaumont, Chao Wang

英文摘要：

We propose a method, based on program analysis and transformation, for eliminating timing side channels in software code that implements security-critical applications. Our method takes as input the original program together with a list of secret variables (e.g., cryptographic keys, security tokens, or passwords) and returns the transformed program as output. The transformed program is guaranteed to be functionally equivalent to the original program and free of both instruction- and cache-timing side channels. Specifically, we ensure that the number of CPU cycles taken to execute any path is independent of the secret data, and the cache behavior of memory accesses, in terms of hits and misses, is independent of the secret data. We have implemented our method in LLVM and validated its effectiveness on a large set of applications, which are cryptographic libraries with 19,708 lines of C/C++ code in total. Our experiments show the method is both scalable for real applications and effective in eliminating timing side channels.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

阅读原文

阅读 PDF ↗

arXiv 页面 ↗HTML 原文 ↗

本文内容

英文摘要相关论文

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

继续探索

相关论文

HyperGI: Automated Detection and Repair of Information Flow Leakage

Maintaining confidential information control in software is a persistent security problem where failure means secrets can be revealed via program behaviors. Information flow control techniques traditionally have been based on static or symbolic analyses -- limited in scalability and specialized to particular languages. When programs do leak secrets there are no approaches to automatically repair them unless the leak causes a functional test to fail. We present our vision for HyperGI, a genetic improvement framework tha detects, localizes and repairs information leakage. Key elements of HyperGI…

2021-08-27cs.CRcs.SE

修复资源包装器中的泄漏

Repairing Leaks in Resource Wrappers

本文提出 Arodnap，通过规范推断、程序变换、字段包含分析和新修复模式处理资源包装器泄漏，将 NJR 基准修复率从 41% 提升至 68%。

2025-10-03cs.CRcs.SE

针对推测执行信息泄露的自动与增量修复

Automatic and Incremental Repair for Speculative Information Leaks

提出首个基于模型检测的框架CureSpec，通过形式化攻击者模型自动检测并修复程序在侧信道和推测执行下的信息泄露，插入缓解措施确保代码可证明安全，并提供可独立检查的安全证书。

2023-05-17cs.CRcs.LO

Automatically Eliminating Speculative Leaks from Cryptographic Code with Blade

We introduce BLADE, a new approach to automatically and efficiently eliminate speculative leaks from cryptographic code. BLADE is built on the insight that to stop leaks via speculation, it suffices to $\textit{cut}$ the dataflow from expressions that speculatively introduce secrets ($\textit{sources}$) to those that leak them through the cache ($\textit{sinks}$), rather than prohibit speculation altogether. We formalize this insight in a $\textit{static type system}$ that (1) types each expression as either $\textit{transient}$, i.e., possibly containing speculative secrets or as being $\text…

2020-12-07cs.CR

通过DSL引导和LLM辅助的修补自动修复TEE分区问题

Automated Repair of TEE Partitioning Issues via DSL-Guided and LLM-Assisted Patching

Singapore Management University（新加坡管理大学）

本文提出TEERepair框架，通过DSL编码修补规则和LLM推理代码语义，自动修复TEE应用中的分区问题，实现87.6%的修复成功率。

2026-05-21cs.CRcs.SE

修补漏洞而无需隐形之手。对LLMs的差异化复制研究

Repairing vulnerabilities without invisible hands. A differentiated replication study on LLMs

University of Trento（特伦托大学）

本文通过受控实验研究LLM在漏洞修复中的表现，发现其修复能力可能受隐藏因素影响，通过偏移故障位置验证模型是否能复现记忆中的修复方案。

2026-01-14cs.CRcs.LGcs.SE

更多相关论文收起更多论文

A Case for Maximal Leakage as a Side Channel Leakage Metric

Side channels represent a broad class of security vulnerabilities that have been demonstrated to exist in many applications. Because completely eliminating side channels often leads to prohibitively high overhead, there is a need for a principled trade-off between cost and leakage. In this paper, we make a case for the use of maximal leakage to analyze such trade-offs. Maximal leakage is an operationally interpretable leakage metric designed for side channels. We present the most useful theoretical properties of maximal leakage from previous work and demonstrate empirically that conventional m…

2020-04-17cs.CRcs.ITmath.IT

Rosita++: Automatic Higher-Order Leakage Elimination from Cryptographic Code

Side-channel attacks are a major threat to the security of cryptographic implementations, particularly for small devices that are under the physical control of the adversary. While several strategies for protecting against side-channel attacks exist, these often fail in practice due to unintended interactions between values deep within the CPU. To detect and protect from side-channel attacks, several automated tools have recently been proposed; one of their common limitations is that they only support first-order leakage. In this work, we present the first automated tool for detecting and elim…

2021-09-24cs.CR

KeyDrown: Eliminating Keystroke Timing Side-Channel Attacks

Besides cryptographic secrets, side-channel attacks also leak sensitive user input. The most accurate attacks exploit cache timings or interrupt information to monitor keystroke timings and subsequently infer typed words and sentences. Previously proposed countermeasures fail to prevent keystroke timing attacks as they do not protect keystroke processing among the entire software stack. We close this gap with KeyDrown, a new defense mechanism against keystroke timing attacks. KeyDrown injects a large number of fake keystrokes in the kernel to prevent interrupt-based attacks and Prime+Probe att…

2017-06-20cs.CR

Massey秘密共享方案在线性计算下泄露问题的研究

On the Leakage of Massey Secret Sharing Schemes under Linear Computations

INRIA（法国国家信息与自动化研究所）；École Polytechnique（巴黎综合理工学院）；LIX, CNRS UMR 7161（LIX实验室，法国国家科学研究中心）

本研究将基于线性精确修复方案的泄露攻击从单一秘密扩展到多个线性相关秘密，支持任意线性计算，扩大了易受攻击的码参数范围，并提出了更现实的攻击模型。

2026-09-18cs.CR

Layered Binary Templating: Efficient Detection of Compiler- and Linker-introduced Leakage

Cache template attacks demonstrated automated leakage of user input in shared libraries. However, for large binaries, the runtime is prohibitively high. Other automated approaches focused on cryptographic implementations and media software but are not directly applicable to user input. Hence, discovering and eliminating all user input side-channel leakage on a cache-line granularity within huge code bases are impractical. In this paper, we present a new generic cache template attack technique, LBTA, layered binary templating attacks. LBTA uses multiple coarser-grained side channel layers as an…

2022-08-04cs.CR

通过输出标签空间的隐私泄露与差分隐私连续学习

Privacy Leakage via Output Label Space and Differentially Private Continual Learning

University of Helsinki（赫尔辛基大学）；CSC – IT Center for Science（CSC – 科学信息中心）；Ericsson Research（爱立信研究）；Aalto University（阿alto大学）

本文提出通过输出标签空间的隐私泄露问题，针对连续学习中的隐私侧信道，提出差分隐私机制和公开标签空间来消除侧信道，实验显示模型在保持隐私的同时准确率更高。

2026-08-24cs.CRcs.LG

Iodine: Verifying Constant-Time Execution of Hardware

To be secure, cryptographic algorithms crucially rely on the underlying hardware to avoid inadvertent leakage of secrets through timing side channels. Unfortunately, such timing channels are ubiquitous in modern hardware, due to its labyrinthine fast-paths and optimizations. A promising way to avoid timing vulnerabilities is to devise --- and verify --- conditions under which a hardware design is free of timing variability, i.e., executes in constant-time. In this paper, we present Iodine: a clock precise, constant-time approach to eliminating timing side channels in hardware. Iodine succeeds …

2019-10-07cs.CR

Vogls：用于硅前功率侧信道分析的快速交互式全时序模拟器

Vogls: a Fast Interactive Full-timing Simulator for Pre-silicon Power Side-Channel Analysis

Radboud University（拉德堡德大学）

研究针对侧信道分析中现有模拟器不足的问题，提出Vogls模拟器。它结合编译代码性能、全时序仿真及细粒度控制，有Python接口和高效跟踪收集工作流程，在案例研究中能在多抽象级别成功恢复密钥。

2026-07-20cs.ARcs.CR

侧信道攻击绕过3D打印机的保护

Side-Channel Attacks Survive Noise Cancellation in 3D Printers

Department of Computer Science, California Polytechnic State University（计算机科学系，加州大学Polytechnic州立大学）；Beacom College of Computer and Cyber Sciences, Dakota State University（计算机与网络科学学院，达科他州立大学）；Idaho National Laboratory（爱达荷国家实验室）；Department of Computational Data Science and Engineering, North Carolina A&T State University（计算数据科学与工程系，北卡罗来纳A&T州立大学）；Department of Engineering, South Carolina State University（工程系，南卡罗来纳州立大学）

首次评估商用3D打印机的主动电机噪声消除（AMNC）硬件对策，发现其完全消除声学信道，但振动信道仍泄漏几何信息，且泄漏具有设备特异性。

2026-08-03cs.CRcs.ETcs.LG