Automated Template-free Synthesis of Instruction-Centric Leakage Contracts for Black-Box CPUs
This work addresses the problem of manually intensive leakage contract creation for CPU security, enabling automated extraction for black-box CPUs.
The authors propose a methodology to automatically synthesize instruction-centric leakage contracts for black-box CPUs, implemented in the tool malcos. They evaluate on x86 and ARM CPUs, showing the contracts are precise and sound with respect to observed leaks, demonstrating feasibility of learning leakage contracts from black-box CPUs.
Side-channel attacks pose a significant security threat for modern computing platforms, because they exploit subtle discrepancies in CPU behaviors to leak sensitive information. To model the information leaked by a CPU via microarchitectural side-channels, recent work proposed leakage contracts: an ISA-level security abstraction that provides the foundations for secure CPU programming. Unfortunately, due to the complexity of current microarchitectures, devising a leakage contract for a CPU requires extensive manual effort and thus modern CPUs lack dedicated leakage contracts. We present a methodology to extract instruction-centric leakage contracts for major CPU architectures with minimal manual intervention. We implemented this technique in malcos, the first template-free tool that automates the synthesis of leakage contracts for black-box CPUs. We evaluate malcos on x86 and ARM CPUs, and show that the contracts it synthesizes are precise and sound with respect to all leaks observed during synthesis. Our results demonstrate that learning leakage contracts from black-box CPUs is feasible.