Revisiting and Evaluating Software Side-channel Vulnerabilities and Countermeasures in Cryptographic Applications

Abstract

We systematize software side-channel attacks with a focus on vulnerabilities and countermeasures in the cryptographic implementations. Particularly, we survey past research literature to categorize vulnerable implementations, and identify common strategies to eliminate them. We then evaluate popular libraries and applications, quantitatively measuring and comparing the vulnerability severity, response time and coverage. Based on these characterizations and evaluations, we offer some insights for side-channel researchers, cryptographic software developers and users. We hope our study can inspire the side-channel research community to discover new vulnerabilities, and more importantly, to fortify applications against them.

References in corpus (8)

• SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution
• A Systematic Evaluation of Transient Execution Attacks and Defenses
• MicroWalk: A Framework for Finding Side Channels in Binaries
• MeltdownPrime and SpectrePrime: Automatically-Synthesized Attacks Exploiting Invalidation-Based Coherence Protocols
• SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks
• When Human cognitive modeling meets PINs: User-independent inter-keystroke timing attacks
• Loophole: Timing Attacks on Shared Event Loops in Chrome
• Did we learn from LLC Side Channel Attacks? A Cache Leakage Detection Tool for Crypto Libraries