SCInfer: Refinement-Based Verification of Software Countermeasures Against Side-Channel Attacks

Abstract

Abstract. Power side-channel attacks, capable of deducing secret using statistical analysis techniques, have become a serious threat to devices in cyber-physical systems and the Internet of things. Random masking is a widely used countermeasure for removing the statistical dependence between secret data and sidechannel leaks. Although there are techniques for verifying whether software code has been perfectly masked, they are limited in accuracy and scalability. To bridge this gap, we propose a refinement-based method for verifying masking countermeasures. Our method is more accurate than prior syntactic type inference based approaches and more scalable than prior model-counting based approaches using SAT or SMT solvers. Indeed, it can be viewed as a gradual refinement of a set of semantic type inference rules for reasoning about distribution types. These rules are kept abstract initially to allow fast deduction, and then made concrete when the abstract version is not able to resolve the verification problem. We have implemented our method in a tool and evaluated it on cryptographic benchmarks including AES and MAC-Keccak. The results show that our method significantly outperforms state-of-the-art techniques in terms of both accuracy and scalability.

Mitigating power side channels during compilation

“…All benchmarks are from public domain, and all of them are masked. The programs P1-P3, in particular, are protected by Boolean masking that previously has been verified [14,35,75]. The other programs, from Barthe et al [8], are masked multiplication [65], masked S-box [30], masked AES [30] and various masked MAC-Keccak functions [8].…”

“…While the time taken to complete type inference is not negligible, e.g., minutes for the larger programs, it is reasonable because we perform a much deeper program analysis than mere compilation. To put it into perspective, the heavy-weight formal verification approaches often take hours [35,75].…”

“…Formal Verification. In general, deciding whether a variable is HW-sensitive, or a pair of variables is HD-sensitive, is NP-hard, since it corresponds to model counting [35,75]. This is illustrated by Table 1, which shows the truth table of Boolean functions t1, t2 and t3 in terms of secret variable k and random variables m1, m2 and m3.…”

“…Following the definitions of supp, unq and dom, it is straightforward to arrive at the basic inference rules [9,57,75]: Here, Rule 1 says if = m ⊕ expr, where m is a random input and expr is not masked by m, then has random uniform distribution. This is due to the property of XOR.…”

Abstract interpretation under speculative execution

“…This approach is generally applicable, regardless of how the abstract state is defined and which algorithm is used to compute the fixed point. For example, the abstract state may model side effects on the cache or pipeline [48,49], the non-functional properties to be verified may be timing or power [17,22,60,64], and the abstract domain may be interval [14] or octagonal [41].…”