# Work in progress: securing critical variables at compile time

Clara Bourgeais, Laure Gonnord, David Hély

<figure><img src="image_1.png" /></figure>

## To cite this version:

Clara Bourgeais, Laure Gonnord, David Hély. Work in progress: securing critical variables at compile time. Compas, Jun 2025, Bordeaux, France. hal-05148976

HAL Id: hal-05148976

https://hal.science/hal-05148976v1

Submitted on 7 Jul 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
## Actually, how are computer systems secured ?

Computer systems are **vulnerable to hardware attacks**, how to protect them ?

### Many countermeasures

* Hardware countermeasures

* Software countermeasures

* Software activable hardware countermeasures

* How to make a system fully secured ?

<figure><img src="image_3.png" /></figure>

<figure><img src="image_4.png" /></figure>

Dead vulnerability

<figure><img src="image_5.png" /></figure>

Hardware countermeasure

<figure><img src="image_6.png" /></figure>

Software activable hardware countermeasure

<figure><img src="image_7.png" /></figure>

Software activation

<figure><img src="image_8.png" /></figure>

Software countermeasure

<figure><img src="image_9.png" /></figure>

## 1. What is a fully secured system ?

* Hardware security properties are expressed at code generation level

* Available hardware countermeasures are exploited

* Software countermeasures correct remaining hardware vulnerabilities

How ? By modifying compilers, especially the back-end

<figure><img src="image_10.png" /></figure>

## 2. Considering spill as leaky

**Spill:** A data moving from a register to the main memory because no register is available to store it.

<figure><img src="image_11.png" /></figure>

Cache access and bus transfer have been discovered to be leaky in the context of side-channel attacks [1, 2].

Leaky(Bus, Cache) Leaky(Spilling)

## 3. How is a variable spilled ?

Of course, during compilation !

* Where ?

* At the back-end level

* During register allocation

* Which techniques are used ?

* By using live-ranges analysis

* And checking the register pressure

<figure><img src="image_12.png" /></figure>

## 4. Live-ranges: Core of the problem

**Live-Range** of a variable: Set of operations existing between its definition and its use.

* Used by register allocators to determine spilling

(1) int a = 10; //key

(2) int b = a + 1;

(3) int c = a + 9;

(4) b = b + a;

(5) a = c;

(6) b = 6;

<figure><img src="image_13.png" /></figure>

How about **selecting live-ranges** of critical variables and **preventing them to spill** ?

## 5. What is the solution ?

* Tracing critical data from the source to the back-end + their dependencies

* By using a tracer (look for Sebastien MICHELLAND)

* By using a hack: inline assembly
  `uint64_t key = 0x2b7e151628aed2a6;`
  `asm volatile ("# key %0":: "r"(key));`

* A new pass before register allocation

* Experimental validation + Proofs

## Towards a new methodology for a hardware/software codesign

* Developed a new codesigned countermeasure

* Showing codesign is possible and is worth studying

* What's next ?

* Applying codesign on formal hardware specifications

<footnote>[1] Wei Hu, Chip-Hong Chang, Anirban Sengupta, Swarup Bhunia, Ryan Kastner, and Hai Li. An Overview of Hardware Security and Trust: Threats, Countermeasures, and Design Tools. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 40(6):1010–1038, June 2021.</footnote>

<footnote>[2] Ezinam Talaki. A Memory Hierarchy Protected against Side-Channel Attacks. PhD thesis, Université Grenoble Alpes [2020-....], September 2022.</footnote>