Tooling Design and Lessons Learned from Systematic Evaluations of the Preservation of(…)
summary
Systematic evaluations use BinSec to run binary-level symbolic execution on two benchmarks: a constant/zeroization suite and post-quantum candidates. The pipeline faces heterogenous build systems, missing or mislabelled public/secret buffers, and target-specific instruction gaps, so many analyses need per-binary manual configuration and tweaks. The effort finds several real vulnerabilities and many spurious or “useless” reports, and benefits from compiler-supported debug annotations to mark secrets.
AI-written summary · about
chapters (7)
- 0:00Tooling design for security
- 2:29Security property challenges
- 3:54Automated tool chains for benchmarks
- 7:15Compilation target incompatibility
- 8:38Constant time in cryptographic algorithms
- 12:49Manual tweaking in evaluations
- 13:33Q&A
related talks
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
50mVerify your software for security bugs
14mCollapsing Towers for Side-Channel Security
53mLocknote: How Badly Do We Want Correct Compilers?
46mRethinking Architectures and Abstraction for a World Where Security Improvements Matter More than Performance Gains
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
27mBinSim: Trace-based Semantic Binary Diffing...
32mCommSec D2 - ProdSec: A Technical Approach