Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security · 2022 · 12 citations · 17 references
ComputingComputer ScienceCybersecurityComputer SecurityCryptographySoftware EngineeringBehavioral AnalysisCryptographic ImplementationSoftware Security EngineeringSoftware Vulnerability DiscoveryStatic Code AnalysisStatic Vulnerability AnalysisExpert Systems Knowledge AcquisitionKnowledge-based Expert SystemsLeak AnalysisSecrets Detection In Source CodeTiming Anomaly Analysis
Secret-dependent timing behavior in cryptographic implementations has resulted in exploitable vulnerabilities, undermining their security. Over the years, numerous tools to automatically detect timing leakage or even to prove their absence have been proposed. However, a recent study at IEEE S&P 2022 showed that, while many developers are aware of one or more analysis tools, they have major difficulties integrating these into their workflow, as existing tools are tedious to use and mapping discovered leakages to their originating code segments requires expert knowledge. In addition, existing tools focus on compiled languages like C, or analyze binaries, while the industry and open-source community moved to interpreted languages, most notably JavaScript.
17
Proceedings of the 11th USENIX Security Symposium
Dan Boneh · 2002 · 2.5K citations
Last-Level Cache Side-Channel Attacks are Practical
Fangfei Liu, Yuval Yarom, Qian Ge et al. · 2015 · 1K citations · Full text
An information-theoretic model for adaptive side-channel attacks
Boris Köpf, David Basin · 2007 · 364 citations
Jalangi: a selective record-replay and dynamic analysis framework for JavaScript
Koushik Sen, Swaroop Kalasapur, Tasneem Brutch et al. · 2013 · 271 citations