Collapsing Towers for Side-Channel Security
summary
A technique uses staging to turn an instrumented interpreter into a compilerlike residue program that exposes a runtime step counter and cache effects as first-class values. An off-the-shelf bounded model checker verifies that the produced timer is invariant across secrets. Prototype swaps in a cache simulator to find naive, cache-based and speculation-based timing leaks, successfully flagging a Spectre-style phantom load; interpreters are handcrafted, single-threaded, and scalability and HDL-driven generation remain the main limitations.
AI-written summary · about
chapters (11)
- 0:00Side-channel security intro
- 1:03Spectre vulnerability
- 3:11Classic vs staging solutions
- 4:15Hardware interpreter
- 5:59Proof of concept
- 7:02Cache simulation & speculation
- 8:04Detecting timing leaks
- 8:48Future work
- 9:31Abstract interpreter
- 9:52Takeaways
- 10:33Q&A
related talks
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
12mHardware Verification of Timing Side Channel Freedom in the Spectre Era
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
16mMitigating Transient-Execution Attacks with CHERI Compartments
20mLifting Compiler Security Properties to Stronger Attackers: the Speculation Cas...
19mDo You Even Lift? Strengthening Compiler Security Guarantees Against Spectre Attacks
20mA Formal Model of Cache Speculation Side-Channels
14mProtecting cryptography code from timing vulnerabilities