CipherGuard: Compiler-aided Mitigation against Ciphertext Side-channel Attacks
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866912665440354304 |
|---|---|
| author | Jiang, Ke Deng, Sen Li, Yinshuai Wang, Shuai Zhang, Tianwei Zhang, Yinqian |
| author_facet | Jiang, Ke Deng, Sen Li, Yinshuai Wang, Shuai Zhang, Tianwei Zhang, Yinqian |
| contents | Recently, the new ciphertext side channels resulting from the deterministic memory encryption in Trusted Execution Environments (TEEs), enable ciphertexts to manifest identifiable patterns when being sequentially written to the same memory address. Attackers with read access to encrypted memory in TEEs can potentially deduce plaintexts by analyzing these changing ciphertext patterns. In this paper, we design CipherGuard, a compiler-based mitigation tool to counteract ciphertext side channels with high efficiency and security guarantees. CipherGuard is based on the LLVM ecosystem, and encompasses multiple defense strategies, including software-assisted probabilistic encryption, secret-aware register allocation, and diversion-based obfuscation. The design of CipherGuard demonstrates that compiler techniques are highly effective for fine-grained control over mitigation code generation and assisted component management. Through a comprehensive evaluation, it demonstrates that CipherGuard can strengthen the security of various cryptographic implementations more efficiently than existing state-of-the-art defense, i.e., CipherFix. In its most efficient strategy, CipherGuard incurs an average performance overhead of only 1.41X, with a maximum of 1.95X. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2502_13401 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | CipherGuard: Compiler-aided Mitigation against Ciphertext Side-channel Attacks Jiang, Ke Deng, Sen Li, Yinshuai Wang, Shuai Zhang, Tianwei Zhang, Yinqian Cryptography and Security Hardware Architecture Recently, the new ciphertext side channels resulting from the deterministic memory encryption in Trusted Execution Environments (TEEs), enable ciphertexts to manifest identifiable patterns when being sequentially written to the same memory address. Attackers with read access to encrypted memory in TEEs can potentially deduce plaintexts by analyzing these changing ciphertext patterns. In this paper, we design CipherGuard, a compiler-based mitigation tool to counteract ciphertext side channels with high efficiency and security guarantees. CipherGuard is based on the LLVM ecosystem, and encompasses multiple defense strategies, including software-assisted probabilistic encryption, secret-aware register allocation, and diversion-based obfuscation. The design of CipherGuard demonstrates that compiler techniques are highly effective for fine-grained control over mitigation code generation and assisted component management. Through a comprehensive evaluation, it demonstrates that CipherGuard can strengthen the security of various cryptographic implementations more efficiently than existing state-of-the-art defense, i.e., CipherFix. In its most efficient strategy, CipherGuard incurs an average performance overhead of only 1.41X, with a maximum of 1.95X. |
| title | CipherGuard: Compiler-aided Mitigation against Ciphertext Side-channel Attacks |
| topic | Cryptography and Security Hardware Architecture |
| url | https://arxiv.org/abs/2502.13401 |