Soteria: Automatically Mitigating Timing Side-Channel Vulnerabilities in Sensitive Programs

Side-channel attacks try to gain information about the secret data in sensitiveprograms through leveraging the difference between the algorithm and its implementation. Most common side-channel vulnerabilities arise from timing variations in program execution, memory access patterns, memory, power, and network consumption, response size, electromagnetic emissions, and acoustics that could be tied back to secret information. For these reasons, sensitive programs (e.g., real-world cryptographic code) are written in a constant-time fashion to avoid timing side-channel vulnerabilities. In this thesis, we present an approach that automatically mitigates timing side-channel vulnerabilities through a set of source-to-source transformations resulting in secret-dependent branch-free code so that there will be no secret-dependent timing variation during the execution of the program