Lecture 015

Timing Attacks

Side Channel Attacks: an attack that exploits information from the physical implementation rather than in algorithm.

timing attacks
power consumption
memory access patterns
sequence of instructions executed
electromagnetic radiation

e.g. attacker can train branch predictor to put some memory in cache, then measure the time to access that memory to infer some information about the program state.

The following code takes more time when lower bits of the $guess$ are correct:

auth := 1;
i := 0;
while (i < len) {
  if pin[i] = guess[i] then
    i := i + 1;
  else
    auth := 0;
    i = len;
}

We can determine the pin in $2 \times len$ guesses.

Time-Sensitive Noninterference

$\Sigma \models \alpha \text{ secure }^t$ (program $\alpha$ satisfies time-sensitive noninterference with respect to security policy $\Sigma$ ) iff:

$(\forall \ell, \omega_1, \omega_2, \nu_1, \nu_2, n_1, n_2) ((\Sigma \vdash \omega_1 \approx_\ell \omega_2 \land \text{eval} \; \omega_1 \; \alpha = (n_1, \nu_1) \land \text{eval} \; \omega_2 \; \alpha = (n_2, \nu_2)) \implies (\Sigma \vdash \nu_1 \approx_\ell \nu_2 \land n_1 = n_2))$

Example: $\alpha_0 = (\text{ while } (pin > 0) pin := pin - 1)$ :

$\omega_1 = (pin \mapsto 0)$ , $\text{ eval } \; \omega_1 \; \alpha_0 = (2, (pin \mapsto 0))$
$\omega_2 = (pin \mapsto 1)$ , $\text{ eval } \; \omega_2 \; \alpha_0 = (6, (pin \mapsto 0))$

Note that short-circuiting in boolean operation is a common source of timing attack. We also need to assume 64 bits or 256 bits integer with modular arithmetic.

"constant time" programming: writing code that takes the same amount of time regardless of the high-security variable values. (which is different from $O(1)$ time complexity)

For branching, it is unrealistic to have two branches take exactly the same amount of time, as compiler optimizations may change timing. Instead, we require conditioning to not depend on high-security variables, and eliminate branching just like writing shader code:

auth := 1;
i := 0;
while (i < len) {
  auth := auth \land (pin[i] = guess[i]);
  i := i + 1;
}

Randomization

The following code is secure given random is uniform in integer domain and $+$ can overflow:

r := random();
pin := pin + r;
guess := guess + r;
auth := 1;
i := 0;
while (i < len) {
  if pin[i] = guess[i] then
    i := i + 1;
  else
    auth := 0;
    i = len;
}

Summary

$\begin{align*} \text{eval}_\mathbb{Z}\; \omega\; c &= (0, c) \\ \text{eval}_\mathbb{Z}\; \omega\; x &= (1, \omega(x)) \\ \text{eval}_\mathbb{Z}\; \omega\; (e_1 + e_2) &= (n_1 + n_2 + 1,\; c_1 + c_2) \\ &\quad \text{where } \text{eval}_\mathbb{Z}\; \omega\; e_1 = (n_1, c_1) \\ &\quad \text{and } \text{eval}_\mathbb{Z}\; \omega\; e_2 = (n_2, c_2) \\[6pt] % \text{eval}_\mathbb{B}\; \omega\; (e_1 \leq e_2) &= (n_1 + n_2 + 1,\; c_1 \leq c_2) \\ &\quad \text{where } \text{eval}_\mathbb{Z}\; \omega\; e_1 = (n_1, c_1) \\ &\quad \text{and } \text{eval}_\mathbb{Z}\; \omega\; e_2 = (n_2, c_2) \\[6pt] % \text{eval}_\mathbb{B}\; \omega\; (\top) &= (0, \top) \\ \text{eval}_\mathbb{B}\; \omega\; (\bot) &= (0, \bot) \\ \text{eval}_\mathbb{B}\; \omega\; (P \wedge Q) &= (n_1 + n_2 + 1,\; b_1 \wedge b_2) \\ &\quad \text{where } \text{eval}_\mathbb{B}\; \omega\; P = (n_1, b_1) \\ &\quad \text{and } \wedge\,\text{eval}_\mathbb{B}\; \omega\; Q = (n_2, b_2) \\[6pt] % \text{eval}\; \omega\; (x := e) &= (n + 1,\; \omega[x \mapsto c]) \\ &\quad \text{where } \text{eval}_\mathbb{Z}\; \omega\; e = (n, c) \\[6pt] % \text{eval}\; \omega\; (\alpha\;;\;\beta) &= (n_1 + n_2 + 1,\; \nu) \\ &\quad \text{where } \text{eval}\; \omega\; \alpha = (n_1, \mu) \\ &\quad \text{and } \text{eval}\; \mu\; \beta = (n + 1, \nu) \\[6pt] % \text{eval}\; \omega\; (\mathbf{skip}) &= (1, \omega) \\[6pt] % \text{eval}\; \omega\; (\textbf{if}\; P\; \textbf{then}\; \alpha\; \textbf{else}\; \beta) &= (k + n + 1,\; \nu) \\ &\quad \text{where } \text{eval}\; \omega\; P = (k, \top) \;\text{ and }\; \text{eval}\; \omega\; \alpha = (n, \nu) \\ &\quad \text{or } \text{eval}\; \omega\; P = (k, \bot) \;\text{ and }\; \text{eval}\; \omega\; \beta = (n, \nu) \\[6pt] % \text{eval}\; \omega\; (\textbf{while}\; P\; \alpha) &= (k + n + 1,\; \nu) \\ &\quad \text{where } \text{eval}\; \omega\; P = (k, \bot) \;\text{ and }\; n = 0 \;\text{ and }\; \nu = \omega \\ &\quad \text{or } \text{eval}\; \omega\; P = (k, \top) \;\text{ and }\; \text{eval}\; \omega\; (\alpha\;;\;\textbf{while}\; P\; \alpha) = (n, \nu) \end{align*}$

$\begin{align*} \frac{\Sigma \vdash e : \ell \quad \ell \sqsubseteq \Sigma(x)}{\Sigma \vdash x := e \;\text{secure}^t} {:=F^t} \qquad& \\ \frac{\Sigma \vdash \alpha \;\text{secure}^t \quad \Sigma \vdash \beta \;\text{secure}^t}{\Sigma \vdash \alpha \;;\; \beta \;\text{secure}^t} {;}F^t \qquad& \frac{}{\Sigma \vdash \mathbf{skip} \;\text{secure}^t} \mathbf{skip}F^t \\ \frac{\Sigma \vdash P : \bot \quad \Sigma \vdash \alpha \;\text{secure}^t \quad \Sigma \vdash \beta \;\text{secure}^t}{\Sigma \vdash \mathbf{if}\; P \;\mathbf{then}\; \alpha \;\mathbf{else}\; \beta \;\text{secure}^t} \mathbf{if}F^t \qquad& \frac{\Sigma \vdash P : \bot \quad \Sigma \vdash \alpha \;\text{secure}^t}{\Sigma \vdash \mathbf{while}\; P\; \alpha \;\text{secure}^t} \mathbf{while}F^t \\ \frac{\Sigma \vdash P : \bot}{\Sigma \vdash \mathbf{test}\; P \;\text{secure}^t} \mathbf{test}F \qquad& \end{align*}$

Table of Content