We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

Unlocking Secret Analysis in GCC Static Analyzer

Formal Metadata

Title
Unlocking Secret Analysis in GCC Static Analyzer
Title of Series
Number of Parts
798
Author
License
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
Language

Content Metadata

Subject Area
Genre
Abstract
GCC Static Analyzer (SA) is a highly promising tool aiming to enhance the compiler with extensive analysis capabilities, such as through the use of a plugin API. We used it to implement an analysis targeting constant-time vulnerabilities. Most of the existing tools rely on formal methods and remain barely used (see Jancar et al.). This study conclude that compiler-based tools are well-received among cryptographic developers. Our initial tests highlighted that the primary design of the analyzer's inner state machines heavily relies on pointer-related analysis, which leverages alias analysis. However, it was triggering undesirable side effects in our case. The needs for our analysis is to also be able to track state for lvalue, alongside rvalue, depending of the target's type. The subject of this talk is to introduce a practical case where this behavior would allow such analysis to be done, especially since the SA codebase is already heavily prepared for it. A proof-of-concept to give this ability to the SA has been implemented and aims to be merged after feedback from the community on the idea. Problems caused by some aspects of C semantics arise and will be interesting to discuss (e.g., the thin frontier between arrays and pointers).