Control-flow Flattening Preserves the Constant-Time Policy (Extended Version)
This addresses a security concern for software developers and users by ensuring obfuscation does not compromise constant-time protections, though it is incremental as it focuses on a specific technique and policy.
The paper tackled the problem of whether control-flow flattening, a common obfuscation technique, preserves the constant-time security policy in software programs, and proved that it does, ensuring programs satisfying the policy remain secure after transformation.
Obfuscating compilers protect a software by obscuring its meaning and impeding the reconstruction of its original source code. The typical concern when defining such compilers is their robustness against reverse engineering and the performance of the produced code. Little work has been done in studying whether the security properties of a program are preserved under obfuscation. In this paper we start addressing this problem: we consider control-flow flattening, a popular obfuscation technique used in industrial compilers, and a specific security policy, namely constant-time. We prove that this obfuscation preserves the policy, i.e., that every program satisfying the policy still does after the transformation.