MAMBO–V: Dynamic Side-Channel Leakage Analysis on RISC–V

RISC–V is an emerging technology, with applications ranging from embedded devices to high-performance servers. Therefore, more and more security-critical workloads will be conducted with code that is compiled for RISC–V. Well-known microarchitectural side-channel attacks against established platforms like x86 apply to RISC–V CPUs as well. As RISC–V does not mandate any hardware-based side-channel countermeasures, a piece of code compiled for a generic RISC–V CPU in a cloud server cannot make safe assumptions about the microarchitecture on which it is running. Existing tools for aiding software-level precautions by checking side-channel vulnerabilities on source code or x86 binaries are not compatible with RISC–V machine code. In this work, we study the requirements and goals of architecture-specific leakage analysis for RISC–V and illustrate how to achieve these goals with the help of fast and precise dynamic binary analysis. We implement all necessary building blocks for finding side-channel leakages on RISC–V, while relying on existing mature solutions when possible. Our leakage analysis builds upon the modular side-channel analysis framework Microwalk, that examines execution traces for leakage through secret-dependent memory accesses or branches. To provide suitable traces, we port the ARM dynamic binary instrumentation tool MAMBO to RISC–V. Our port named MAMBO–V can instrument arbitrary binaries which use the 64-bit general purpose instruction set. We evaluate our toolchain on several cryptographic libraries with RISC–V support and identify multiple leakages.