[论文解读] SplittingSecrets: A Compiler-Based Defense for Preventing Data Memory-Dependent Prefetcher Side-Channels

Reshabh K Sharma, Dan Grossman+1 more|arXiv (Cornell University)|Jan 18, 2026

Security and Verification in Computing被引用 0

一句话总结

SplittingSecrets 是一个基于编译器的工具，通过在内存中分割秘密并使用无意义前缀来防止 DMP 侧信道，保护跨 CPU 的加密代码。

ABSTRACT

Traditional side-channels take advantage of secrets being used as inputs to unsafe instructions, used for memory accesses, or used in control flow decisions. Constant-time programming, which restricts such code patterns, has been widely adopted as a defense against these vulnerabilities. However, new hardware optimizations in the form of Data Memory-dependent Prefetchers (DMP) present in Apple, Intel, and ARM CPUs have shown such defenses are not sufficient. These prefetchers, unlike classical prefetchers, use the content of memory as well as the trace of prior accesses to determine prefetch targets. An adversary abusing such a prefetcher has been shown to be able to mount attacks leaking data-at-rest; data that is never used by the program, even speculatively, in an unsafe manner. In response, this paper introduces SplittingSecrets, a compiler-based tool that can harden software libraries against side-channels arising from DMPs. SplittingSecrets's approach avoids reasoning about the complex internals of different DMPs and instead relies on one key aspect of all DMPs: activation requires data to resemble addresses. To prevent secret data from leaking, SplittingSecrets transforms memory operations to ensure that secrets are never stored in memory in a manner resembling an address, thereby avoiding DMP activation on those secrets. Rather than disable a DMP entirely, SplittingSecrets can provide targeted hardening for only specific secrets entirely in software. We have implemented SplittingSecrets using LLVM, supporting both source-level memory operations and those generated by the compiler backend for the AArch64 architecture, We have analyzed the performance overhead involved in safeguarding secrets from DMP-induced attacks using common primitives in libsodium, a popular cryptographic library when built for Apple M-series CPUs.

研究动机与目标

• 推动并解决绕过传统常量时间防御的数据内存相关预取器（DMP）侧信道问题。
• 提出一种基于编译器的转换，防止秘密参与 DMP 页遍历。
• 在 ARM64 的 LLVM 中实现该方法，并评估对密码库的性能开销。
• 提供一个仅软件层面的防御，在已知的 DMP 启用 CPU 上工作，无需对硬件进行特权变更。

提出的方法

• 将内存存储和加载转换为使秘密驻留在不会触发有效 DMP 页遍历的内存位置，通过用固定且不匹配的高半部对 64 位字进行前缀化来实现。
• 将秘密分成 32 位块，使用额外分配的内存存储交替的块并附带持久前缀。
• 在源代码或编译器生成的内存操作上使用指针的上位位标签对秘密内存进行注解和跟踪，以实现动态跟踪。
• 为秘密分配并映射额外内存，提供运行时以处理秘密跟踪和访问检查。
• 在 LLVM IR 针对源级操作以及在 MIR 针对 AArch64 后端应用转换，涵盖栈、堆和全局秘密。
• 通过广泛的单元测试和 libsodium 的测试来确保正确性，通过保证转换后的数据不能参与 DMP 页遍历来提升安全性。

Figure 1 : The end-to-end pipeline of SplittingSecrets . Extra memory is allocated for annotated secrets, with the top bits of addresses set for dynamic tracking. At the LLVM IR level, memory operations are instrumented with checks and transformed loads and stores for our defense. Memory operations

实验结果

研究问题

• RQ1 编译器级内存转换是否能在不同体系结构上防止数据内存相关的预取器侧信道？
• RQ2 SplittingSecrets 在防止 DMP 触发泄露方面的效果如何，同时能否保留程序语义？
• RQ3 在保护密码库不受 DMP 侧信道影响时，性能/内存开销是多少？
• RQ4 通过旋转前缀或调整秘密分段大小，方法是否可适应不同的 DMP 实现？

主要发现

• 该工具在 ARM64 的 LLVM 中实现，面向密码学库。
• 秘密数据被分成 32 位块并带有固定前缀以防止页遍历。
• 为秘密分配额外内存并由运行时跟踪秘密位置以实现正确的加载/存储。
• 该方法设计为跨平台、可通过更改前缀适应各种 DMP 设计。
• 在 libsodium 上的评估显示，软件层防御在不更改硬件的情况下是可行的。

Figure 2 : Example of transforming a 256-bit unsafe store. Each circle represents 64 bits. 64-bit chunks of the input (e.g the magenta and blue semi-circles) are split and padded with a 32-bit fixed constant value (black semi-circle.) The lower half with padding is stored at the original memory loca