[Paper Review] Binsec/Rel: Efficient Relational Symbolic Execution for Constant-Time at Binary-Level

Lesly-Ann Daniel, Sébastien Bardin+1 more|arXiv (Cornell University)|Dec 18, 2019

Security and Verification in Computing80 references53 citations

TL;DR

Binsec/Rel is a binary-level relational symbolic execution tool for constant-time analysis that enables bug-finding and bounded-verification, delivering major speedups over prior approaches and uncovering CT violations caused by compiler optimizations.

ABSTRACT

The constant-time programming discipline (CT) is an efficient countermeasure against timing side-channel attacks, requiring the control flow and the memory accesses to be independent from the secrets. Yet, writing CT code is challenging as it demands to reason about pairs of execution traces (2- hypersafety property) and it is generally not preserved by the compiler, requiring binary-level analysis. Unfortunately, current verification tools for CT either reason at higher level (C or LLVM), or sacrifice bug-finding or bounded-verification, or do not scale. We tackle the problem of designing an efficient binary-level verification tool for CT providing both bug-finding and bounded-verification. The technique builds on relational symbolic execution enhanced with new optimizations dedicated to information flow and binary-level analysis, yielding a dramatic improvement over prior work based on symbolic execution. We implement a prototype, Binsec/Rel, and perform extensive experiments on a set of 338 cryptographic implementations, demonstrating the benefits of our approach in both bug-finding and bounded-verification. Using Binsec/Rel, we also automate a previous manual study of CT preservation by compilers. Interestingly, we discovered that gcc -O0 and backend passes of clang introduce violations of CT in implementations that were previously deemed secure by a state-of-the-art CT verification tool operating at LLVM level, showing the importance of reasoning at binary-level.

Motivation & Objective

• Motivate robust protection against timing side-channel attacks by ensuring control flow and memory accesses are independent of secrets (constant-time).
• Overcome limitations of high-level CT analysis by providing a binary-level verifier that supports bug-finding and bounded-verification.
• Develop a scalable, compiler-agnostic analysis tool that handles real cryptographic implementations on x86 and ARM.
• Introduce relational symbolic execution techniques tailored for binary-level information flow to improve scalability and precision.

Proposed method

• Extend relational symbolic execution (RelSE) to binary-level analysis to model two traces following the same path with maximal sharing.
• Introduce on-the-fly simplifications for binary-level information flow tracking to reduce solver queries.
• Develop untainting and fault-packing techniques to refine how secrets influence memory and execution.
• Use Dynamic Bitvector Automata (DBA) as an intermediate representation to model binary programs and leakage.
• Provide a formal correctness basis proving bug-finding and bounded-verification soundness for CT.
• Demonstrate effectiveness on 338 cryptographic implementations, including automated counterexample generation and CT preservation studies.

Experimental results

Research questions

• RQ1 Can Binsec/Rel scale to real cryptographic binaries while preserving complete bug-finding and bounded-verification for constant-time?
• RQ2 How can binary-level information-flow tracking be enhanced to maximize sharing and minimize solver queries in relational symbolic execution?
• RQ3 Do compiler optimizations (e.g., gcc -O0, clang backends) introduce CT violations not detected by LLVM-level CT verification tools?
• RQ4 How does Binsec/Rel compare to self-composition and RelSE in terms of speed, coverage, and ability to prove CT on cryptographic code?

Key findings

• Binsec/Rel analyzes about 23 million instructions in 98 minutes, achieving substantial practical scalability.
• The tool outperforms state-of-the-art binary-level CT verification approaches by large margins in bug-finding and bounded-verification scenarios.
• RelSE and self-composition alone fail to scale on binary-level CT for real cryptographic implementations, whereas Binsec/Rel provides a dramatic speedup.
• Compiler optimizations (gcc -O0 and clang backend passes) can introduce CT violations that are missed by LLVM-level CT tools, underscoring the need for binary-level analysis.
• Binsec/Rel demonstrates 700x speedup in bug-finding over comparable approaches and near-standard SE overhead for bounded-verification.
• The approach enables automated replay of prior CT bugs and generation of counterexamples across 408 configurations and 296 cryptographic implementations, validating CT preservation concerns across compilers and architectures.