“They’re not that hard to mitigate”: What Cryptographic Library
Developers Think About Timing Attacks

D 2022

“They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks

JANČÁR, Ján, Marcel FOURNÉ, Daniel DE ALMEIDA BRAGA, Mohamed SABT, Peter SCHWABE et. al.

Základní údaje

Originální název

“They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks

Autoři

JANČÁR, Ján (703 Slovensko, garant, domácí), Marcel FOURNÉ, Daniel DE ALMEIDA BRAGA, Mohamed SABT, Peter SCHWABE, Gilles BARTHE, Pierre-Alain FOUQUE a Yasemin ACAR

Vydání

San Francisco, 43rd IEEE Symposium on Security and Privacy, od s. 632-649, 18 s. 2022

Nakladatel

IEEE

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

Website

Kód RIV

RIV/00216224:14330/22:00125058

Organizační jednotka

Fakulta informatiky

ISBN

978-1-6654-1316-9

ISSN

DOI

http://dx.doi.org/10.1109/SP46214.2022.9833713

UT WoS

000852887300037

Klíčová slova anglicky

constant-time; timing attacks; crypto library; survey; developer survey; expert survey; usable security; human factors; cryptography

Štítky

core_A, firank_1

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 28. 3. 2023 12:57, RNDr. Pavel Šmerk, Ph.D.

Anotace

V originále

Timing attacks are among the most devastating side- channel attacks, allowing remote attackers to retrieve secret material, including cryptographic keys, with relative ease. In principle, “these attacks are not that hard to mitigate”: the basic intuition, captured by the constant-time criterion, is that control- flow and memory accesses should be independent from secrets. Furthermore, there is a broad range of tools for automatically checking adherence to this intuition. Yet, these attacks still plague popular crypto libraries twenty-five years after their discovery, reflecting a dangerous gap between academic research and crypto engineering. This gap can potentially undermine the emerging shift towards high-assurance, formally verified crypto libraries. However, the causes for this gap remain uninvestigated. To understand the causes of this gap, we conducted a survey with 44 developers of 27 prominent open-source cryptographic libraries. The goal of the survey was to analyze if and how the developers ensure that their code executes in constant time. Our main findings are that developers are aware of timing attacks and of their potentially dramatic consequences and yet often prioritize other issues over the perceived huge investment of time and resources currently needed to make their code resistant to timing attacks. Based on the survey, we identify several shortcomings in existing analysis tools for constant-time, and issue recommendations that can make writing constant- time libraries less difficult. Our recommendations can inform future development of analysis tools, security-aware compilers, and crypto libraries, not only for constant-timeness, but in the broader context of side-channel attacks, in particular for micro- architectural side-channel attacks.

Návaznosti

GA20-03426S, projekt VaV

Název: Ověření a zlepšení bezpečnosti kryptografie eliptických křivek

Investor: Grantová agentura ČR, Ověření a zlepšení bezpečnosti kryptografie eliptických křivek

MUNI/A/1230/2021, interní kód MU

Název: Zapojení studentů Fakulty informatiky do mezinárodní vědecké komunity 22 (Akronym: SKOMU)

Investor: Masarykova univerzita, Zapojení studentů Fakulty informatiky do mezinárodní vědecké komunity 22

Citovat

JANČÁR, Ján, Marcel FOURNÉ, Daniel DE ALMEIDA BRAGA, Mohamed SABT, Peter SCHWABE, Gilles BARTHE, Pierre-Alain FOUQUE a Yasemin ACAR. “They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks. Online. In 43rd IEEE Symposium on Security and Privacy. San Francisco: IEEE, 2022, s. 632-649. ISBN 978-1-6654-1316-9. Dostupné z: https://dx.doi.org/10.1109/SP46214.2022.9833713.

@inproceedings{1804658,
   author = {Jančár, Ján and Fourné, Marcel and De Almeida Braga, Daniel and Sabt, Mohamed and Schwabe, Peter and Barthe, Gilles and Fouque, PierreandAlain and Acar, Yasemin},
   address = {San Francisco},
   booktitle = {43rd IEEE Symposium on Security and Privacy},
   doi = {http://dx.doi.org/10.1109/SP46214.2022.9833713},
   keywords = {constant-time; timing attacks; crypto library; survey; developer survey; expert survey; usable security; human factors; cryptography},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {San Francisco},
   isbn = {978-1-6654-1316-9},
   pages = {632-649},
   publisher = {IEEE},
   title = {“They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks},
   url = {https://crocs.fi.muni.cz/public/papers/usablect_sp22},
   year = {2022}
}

TY  - JOUR
ID  - 1804658
AU  - Jančár, Ján - Fourné, Marcel - De Almeida Braga, Daniel - Sabt, Mohamed - Schwabe, Peter - Barthe, Gilles - Fouque, Pierre-Alain - Acar, Yasemin
PY  - 2022
TI  - “They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks
PB  - IEEE
CY  - San Francisco
SN  - 9781665413169
KW  - constant-time
KW  - timing attacks
KW  - crypto library
KW  - survey
KW  - developer survey
KW  - expert survey
KW  - usable security
KW  - human factors
KW  - cryptography
UR  - https://crocs.fi.muni.cz/public/papers/usablect_sp22
N2  - Timing attacks are among the most devastating side- channel attacks, allowing remote attackers to retrieve secret material, including cryptographic keys, with relative ease. In principle, “these attacks are not that hard to mitigate”: the basic intuition, captured by the constant-time criterion, is that control- flow and memory accesses should be independent from secrets. Furthermore, there is a broad range of tools for automatically checking adherence to this intuition. Yet, these attacks still plague popular crypto libraries twenty-five years after their discovery, reflecting a dangerous gap between academic research and crypto engineering. This gap can potentially undermine the emerging shift towards high-assurance, formally verified crypto libraries. However, the causes for this gap remain uninvestigated. To understand the causes of this gap, we conducted a survey with 44 developers of 27 prominent open-source cryptographic libraries. The goal of the survey was to analyze if and how the developers ensure that their code executes in constant time. Our main findings are that developers are aware of timing attacks and of their potentially dramatic consequences and yet often prioritize other issues over the perceived huge investment of time and resources currently needed to make their code resistant to timing attacks. Based on the survey, we identify several shortcomings in existing analysis tools for constant-time, and issue recommendations that can make writing constant- time libraries less difficult. Our recommendations can inform future development of analysis tools, security-aware compilers, and crypto libraries, not only for constant-timeness, but in the broader context of side-channel attacks, in particular for micro- architectural side-channel attacks.
ER  -

JANČÁR, Ján, Marcel FOURNÉ, Daniel DE ALMEIDA BRAGA, Mohamed SABT, Peter SCHWABE, Gilles BARTHE, Pierre-Alain FOUQUE a Yasemin ACAR. “They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks. Online. In \textit{43rd IEEE Symposium on Security and Privacy}. San Francisco: IEEE, 2022, s.~632-649. ISBN~978-1-6654-1316-9. Dostupné z: https://dx.doi.org/10.1109/SP46214.2022.9833713.

Podrobný výpis o publikaci