Write a Blog >>
PLDI 2020
Mon 15 - Fri 19 June 2020
Fri 19 Jun 2020 13:00 - 13:20 at PLDI Research Papers live stream - Symbolic Execution Chair(s): Qirun Zhang

The constant-time discipline is a software-based countermeasure used for protecting high assurance cryptographic implementations against timing side-channel attacks. Constant-time is effective (it protects against many known attacks), rigorous (it can be formalized using program semantics), and amenable to automated verification. Yet, the advent of micro-architectural attacks makes constant-time as it exists today far less useful.

This paper lays foundations for constant-time programming in the presence of speculative and out-of-order execution. We present an operational semantics and a formal definition of constant-time programs in this extended setting. Our semantics eschews formalization of microarchitectural features (that are instead assumed under adversary control), and yields a notion of constant-time that retains the elegance and tractability of the usual notion. We demonstrate the relevance of our semantics in two ways: First, by contrasting existing Spectre-like attacks with our definition of constant-time. Second, by implementing a static analysis tool, Pitchfork, which detects violations of our extended constant-time property in real world cryptographic libraries.

Fri 19 Jun

Displayed time zone: Pacific Time (US & Canada) change

13:00 - 14:00
Symbolic ExecutionPLDI Research Papers at PLDI Research Papers live stream
Chair(s): Qirun Zhang Georgia Institute of Technology, USA

YouTube lightning session video

Constant-Time Foundations for the New Spectre Era
PLDI Research Papers
Sunjay Cauligi University of California at San Diego, USA, Craig Disselkoen University of California at San Diego, USA, Klaus v. Gleissenthall University of California at San Diego, USA, Dean Tullsen University of California at San Diego, USA, Deian Stefan University of California at San Diego, USA, Tamara Rezk Inria, France, Gilles Barthe MPI for Security and Privacy, Germany / IMDEA Software Institute, Spain
Gillian, Part I: A Multi-language Platform for Symbolic Execution
PLDI Research Papers
José Fragoso Santos INESC-ID/Instituto Superior Técnico, Portugal , Petar Maksimović Imperial College London, UK, Sacha-Élie Ayoun Imperial College London, UK, Philippa Gardner Imperial College London, UK
Efficient Handling of String-Number Conversion
PLDI Research Papers
Parosh Aziz Abdulla Uppsala University, Sweden, Mohamed Faouzi Atig Uppsala University, Sweden, Yu-Fang Chen Academia Sinica, Taiwan, Bui Phi Diep Uppsala University, Sweden, Julian Dolby IBM Research, USA, Petr Janků Brno University of Technology, Czechia, Hsin-Hung Lin Academia Sinica, Taiwan, Lukáš Holík Brno University of Technology, Czechia, Wei-Cheng Wu University of Southern California, USA