Towards A Reliable Methodology for Creating Leakage Resilient Softwar...

Over 20 years after the initial introduction of timing, power, and EM as sources for additional information that create formidable adversaries, there is still a considerable gap between theoretical leakage resilience and practical side channel security. In my talk I will examine this gap by considering a number of questions/angles: what is the difference between (various) theoretical models for leakage and the actual leakage observed from a complex microprocessor; how can we capture and express complex leakage as observed in practice, and how can we realistically validate a piece of software w.r.t. it's security?