Search papers, labs, and topics across Lattice.
This paper introduces malcos, a novel tool that automates the synthesis of instruction-centric leakage contracts for black-box CPUs, significantly reducing the manual effort traditionally required. By evaluating malcos on x86 and ARM architectures, the authors demonstrate that the synthesized contracts are both precise and sound, effectively capturing all observed leaks during the synthesis process. This advancement addresses the critical gap in security abstractions for modern CPUs, enabling more robust defenses against side-channel attacks.
Automating the synthesis of leakage contracts could revolutionize CPU security by eliminating the need for extensive manual effort in their development.
Side-channel attacks pose a significant security threat for modern computing platforms, because they exploit subtle discrepancies in CPU behaviors to leak sensitive information. To model the information leaked by a CPU via microarchitectural side-channels, recent work proposed leakage contracts: an ISA-level security abstraction that provides the foundations for secure CPU programming. Unfortunately, due to the complexity of current microarchitectures, devising a leakage contract for a CPU requires extensive manual effort and thus modern CPUs lack dedicated leakage contracts. We present a methodology to extract instruction-centric leakage contracts for major CPU architectures with minimal manual intervention. We implemented this technique in malcos, the first template-free tool that automates the synthesis of leakage contracts for black-box CPUs. We evaluate malcos on x86 and ARM CPUs, and show that the contracts it synthesizes are precise and sound with respect to all leaks observed during synthesis. Our results demonstrate that learning leakage contracts from black-box CPUs is feasible.
