Semi-automatic ladderisation: improving code security through rewriting and dependent types

Christopher Brown, Adam David Barwell, Yoann Marquer, Olivier Zendra, Tania Richmond, Chen Gu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

3 Downloads (Pure)

Abstract

Cyber attacks become more and more prevalent every day.An arms race is thus engaged between cyber attacks and cyber defences.One type of cyber attack is known as a side channel attack, where attackers exploit information leakage from the physical execution of a program, e.g. timing or power leakage, to uncover secret information, such as encryption keys or other sensitive data. There have been various attempts at addressing the problem of side-channel attacks, often relying on various measures to decrease the discernibility of several code variants or code paths. Most techniques require a high-degree of expertise by the developer, who often employs ad hoc, hand-crafted code-patching in an attempt to make it more secure. In this paper, we take a different approach: building on the idea of ladderisation, inspired by Montgomery Ladders. We present a semi-automatic tool-supported technique, aimed at the non-specialised developer, which refactors (a class of) C programs into functionally (and even algorithmically) equivalent counterparts with improved security properties. Our approach provides refactorings that transform the source code into its ladderised equivalent, driven by an underlying verified rewrite system, based on dependent types. Our rewrite system automatically finds rewritings of selected C expressions, facilitating the production of their equivalent ladderised counterparts for a subset of C. Using our tool-supported technique, we demonstrate our approach on a number of representative examples from the cryptographic domain, showing increased security.
Original languageEnglish
Title of host publicationPEPM 2022: Proceedings of the 2022 ACM SIGPLAN International Workshop on Partial Evaluation and Program Manipulation
EditorsZena M. Ariola, Youyou Cong
Place of PublicationNew York
PublisherACM
Number of pages13
ISBN (Print)9781450391887
DOIs
Publication statusPublished - 17 Jan 2022
EventPOPL '22: The 49th Annual ACM SIGPLAN Symposioum on Principles of Programming Languages - Philadephia, United States
Duration: 17 Jan 202218 Jan 2022
https://dl.acm.org/doi/proceedings/10.1145/3498886

Conference

ConferencePOPL '22: The 49th Annual ACM SIGPLAN Symposioum on Principles of Programming Languages
Country/TerritoryUnited States
CityPhiladephia
Period17/01/2218/01/22
Internet address

Keywords

  • Security
  • Dependent types
  • Idris
  • Soundness
  • Refactoring
  • Rewriting
  • Semantics
  • Side-channel attacks
  • Fault injection

Fingerprint

Dive into the research topics of 'Semi-automatic ladderisation: improving code security through rewriting and dependent types'. Together they form a unique fingerprint.

Cite this