Veronika Hanulíková
A PhD candidate at Masaryk University and a member of the Centre for Research on Cryptography and Security (CRoCS). Her research focuses on securing cryptographic implementations in resource-constrained devices, where she specializes in uncovering hidden side-channel leakages and evaluating countermeasures on smart cards.
Přednáška
Timing side-channel vulnerabilities can expose sensitive information in cryptographic implementations, yet detecting them on Java Card smart cards remains challenging. These platforms restrict access to internal timing information, while host-side measurements often lack the precision needed to identify subtle, data-dependent execution differences.
This talk presents a practical approach that combines differential fuzzing with Simple Power Analysis (SPA) to detect and investigate timing leaks in Java Card applications. Differential fuzzing automatically generates inputs that may trigger different execution paths, and SPA-based profiling uses power traces collected from a real card to precisely reconstruct execution timing. Together, these techniques provide a workflow for discovering leaks and validating their behavior on actual hardware.
The framework is demonstrated on open-source Java Card applications, revealing timing differences that are difficult to detect with traditional methods. Although designed for Java Card, the approach can also be applied to other embedded and cryptographic systems where timing information is limited, but source code and power measurements are available.