Dude, Is My Code Constant Time?
Oscar Reparaz, Josep Balasch and Ingrid Verbauwhede
KU Leuven/COSIC and Imec, Leuven, Belgium
ABSTRACT
This paper introduces dudect: a tool to assess whether a piece of code runs in constant time or not on a given platform. We base our approach on leakage detection techniques, resulting in a very compact, easy to use and easy to maintain tool. Our methodology fits in around 300 lines of C and runs on the target platform. The approach is substantially different from previous solutions. Contrary to others, our solution requires no modeling of hardware behavior. Our solution can be used in black-box testing, yet benefits from implementation details if available. We show the effectiveness of our approach by detecting several variable-time cryptographic implementations. We place a prototype implementation of dudect in the public domain.
Keywords: Timing attacks, Leakage detection, Tools for secure software implementations, Secure coding methodology, Constant-time implementations.
