Keynotes
Hugo Lefeuvre is a Postdoctoral Research Fellow at the University of British Columbia in Vancouver (Canada), where he researches topics at the intersection of systems and security. Earlier he was a PhD candidate at the University of Manchester (UK) and a Microsoft PhD Research Fellow. His PhD dissertation was awarded the EuroSys Roger Needham PhD Award.
Software Compartmentalization Everywhere - What Will it Take?
Software compartmentalization is the practice of breaking down a program into isolated components to mitigate the impact of bugs and security vulnerabilities. In the event of a compromise, compartmentalization contains the exploit, raising the bar for attackers to mount successful attacks. Although vastly successful in popular software such as web browsers or server software, compartmentalization is still not a widespread software development practice. In this talk, based on our recent publication "SoK: Software Compartmentalization" at IEEE S&P 2025, we will discuss compartmentalization approaches in industry and academia to understand the remaining challenges to making compartmentalization a truly widespread practice, raise awareness on this practice, and show how it can lead to fundamentally more secure and dependable software.
Language: English (subtitled in French)
Clémentine Maurice is a Research Scientist at CNRS in the CRIStAL laboratory in Lille. She received her PhD from Telecom ParisTech in 2015, and subsequently worked as a postdoctoral researcher at Graz University of Technology in Austria. Her research focuses on microarchitectural attacks and their countermeasures. She also presented her work at hacker conferences such as CCC and Blackhat Europe, and is featured twice in the Mozilla Hall of Fame.
From Theory to Practice: Detecting and Preserving Constant-Time
Side-channel vulnerabilities keep showing up in cryptographic software—despite a decade of automated detection tools meant to stop them. Why do these leaks keep slipping through? In the first part of this keynote, we explore this paradox, benchmarking tools against real-world vulnerabilities and uncovering why detection is harder than it looks. In the second part, we show that even when developers get constant-time code right, the compiler may not. Optimization passes in GCC and LLVM can quietly sabotage security, turning constant time into wishful thinking. We reveal which optimizations are to blame, how to catch them, and what practical defenses developers can actually use. Your compiler is not your friend—but with the right knowledge, you can keep it from turning against you.We conclude by analyzing the impact of recent attacks on automated detection tools.
Language: English (subtitled in French)