From Trust Anchors to Melt ltdown of f Trust Ahmad-Reza Sadeghi - - PowerPoint PPT Presentation

▶
from trust anchors to melt ltdown of f trust
SMART_READER_LITE
LIVE PREVIEW

From Trust Anchors to Melt ltdown of f Trust Ahmad-Reza Sadeghi - - PowerPoint PPT Presentation

Aug 27, 2023 167 likes •1.96k views

Hardware-assisted Security: : From Trust Anchors to Melt ltdown of f Trust Ahmad-Reza Sadeghi Technische Universitt Darmstadt & Intel Collaborative Research Institute for Collaborative & Resilient Autonomous Systems His istorical

slide-1
SLIDE 1

Hardware-assisted Security: : From Trust Anchors to Melt ltdown of f Trust

Ahmad-Reza Sadeghi Technische Universität Darmstadt & Intel Collaborative Research Institute for Collaborative & Resilient Autonomous Systems

slide-2
SLIDE 2

His istorical Overview: : Deployed Systems

Cambridge CAP

1970 1980 1990 2000 2010

Reference monitor Protection rings VAX/VMS Java security architecture Hardware-assisted secure boot Trusted Platform Module (TPM) Late launch/TXT Computer security Mobile security Smart card security Mobile hardware security architectures TI M-Shield ARM TrustZone Mobile OS security architectures Mobile Trusted Module (MTM) Simple smart cards Java Card platform TPM 2.0 Intel SGX GP TEE standards On-board Credentials PUFs

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-3
SLIDE 3

Deployed HW-Assisted Security Technologies

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-4
SLIDE 4

Deployed HW-Assisted Security Technologies

Fantastic Sad Total Disaster Very Sad Complicated?

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-5
SLIDE 5

His istorical Overview: : Research

On-board Credentials (ObC)

2000 2004 2008 2012 2018

Sanctum Bastion AEGIS Trusted Execution Security Extensions HAFIX ObC HardBound TrustLite TyTAN SMART Sancus

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-6
SLIDE 6

HW HW-Assisted Security Technologies: : Research

Fantastic Almost Optimistic Total Disaster Sad Complicated?

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-7
SLIDE 7

We We Need Change of f Cult lture!

slide-8
SLIDE 8

Today’s Systems: Attack Surface

Hardware Software Stack Operating System App 1 App 2 App 4 App 3 Peripherals CPU I/O Hardware Software Stack Memory

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-9
SLIDE 9

Goal: : Self lf-Contained Security

Operating System App 1 App 2 App 4 App 3 Hardware Software Stack Peripherals CPU I/O Memory

  • Isolated

execution

  • Platform

integrity

  • Secure storage
  • Device

identification

  • Device

authentication capabilities

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-10
SLIDE 10

In Intrinsic Security Prim imitives: The PUF Myt yth

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-11
SLIDE 11

Physically Unclonable Functions (P (PUFs)

Device Hardware Fingerprint (unique intrinsic identifier) Infeasible to predict

Challenge/response behavior is pseudo-random

Inherently Unclonable

Due to unpredictable randomness during manufacturing of tag

≠

Tamper-evident

Tampering with the PUF hardware changes challenge/response behavior

Physically Unclonable Function (noisy function based on physical properties) Challenge 𝑑 Response 𝑠

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-12
SLIDE 12

2001 2002-2004 2006 2007 2008

SELECTED PUFs

Optical PUF

[P.Ravikanth, 2001]

Arbiter PUF & RO-PUF

[Gassend et al., CCS‘02]

Feed-Forward A-PUF

[Lee et al., VLSIC’04]

Coating PUF

[Tuyls et al., CHES’06]

SRAM PUF

[Guajardo et al., CHES’07][Holcomb et al., RFIDSec’07]

Latch PUF

[Su et al., ISSCC‘07]

XOR A-PUF

[Suh et al., DAC’07]

Lightweight PUF

[Majzoobi et al., ICCAD‘08]

Flip-Flop PUF

[Kumar et al., WiSec’08]

Butterfly PUF

[Su et al., HOST‘08]

2010-2011

Glitch PUF

[Anderson et al., ASP-DAC‘10]

2012-2013 2016-now

Bistable Ring PUF

[Chen et al., HOST‘11]

Current-based PUF

[Majzoobi et al., ISCAS‘11]

Flash PUF

[Prabhu et al., ICTTC‘11]

Buskeeper PUF

[Simons et al., HOST‘12]

DRAM PUF

[Rosenblatt et al., SSC‘13]

Bitline PUF

[Holcomb et al., CHES‘14]

MEMS PUF

[Willers et al., CCS‘16]

Row Hammer-PUF

[Schaller et al., HOST‘17]

Memory-based PUFs Delay-based PUFs Other PUFs

Processor-based PUF

[Kong et al., DAC’14]

Subthreshold Current PUF

[Kalyanaraman et al., HOST‘13]

Current Mirrors PUF

[Kumar et al., HOST‘14]

Voltage Transfer PUF

[Vijaykumar et al., DATE‘15]

2014-2015

EU UNIQUE Project

MXPUF

[Nguyen et al., eprint‘17]

Monte Carlo PUF

[Rožić et al., FPT ‘17]

www.unique-project.eu

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-13
SLIDE 13

Arbiter PUF & RO-PUF

[Gassend et al., CCS‘02]

Feed-Forward A-PUF

[Lee et al., VLSIC’04]

SRAM PUF

[Guajardo et al., CHES’07] [Holcomb et al., RFIDSec’07]

XOR A-PUF

[Suh et al., DAC’07]

Lightweight PUF

[Majzoobi et al., ICCAD‘08]

Flip-Flop PUF

[Kumar et al., WiSec’08]

DRAM PUF

[Rosenblatt et al., SSC‘13]

Row Hammer-PUF

[Schaller et al., HOST‘17]

The output determined by the faster path The output is based on the state of memory cells after a power cycle

Delay-based PUFs Memory-based PUFs

Power-on / / / 1 1 / / / 1 1 1 / 1 / / 1 1 1 1 1

PUFs: : Main in Categories

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-14
SLIDE 14

Example: Arb rbiter PUF

Pair of identically designed delay lines

  • Ideally both paths have the same delay
  • Arbiter determines signal arrives first
  • Challenge dependent switches
  • Different delay paths by switches

𝑥0

𝑣

𝑥0

𝑚

Switch

𝑥1

𝑣

𝑥1

𝑚

𝒅𝟏 = 0 𝒅𝟏 = 1

Response Impulse

1

𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕

Challenge

Manufacturing variations affect delay lines

  • Either of the two paths will be faster
  • One bit response at signal arrival

Arbiter

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-15
SLIDE 15

How Good are PUFs in in Practice?

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-16
SLIDE 16

Arbiter PUF

[Gassend et al., CC‘04]

SRAM PUF

[Guajardo et al., CHES’07] [Holcomb et al., RFIDSec’07]

Delay-based PUFs Memory-based PUFs

Modeling Attacks

[Lee et al., VLSIC’04]

Physical Attacks

[Oren et al., CHES’13] [Helfmeier et al., HOST’13]

Linear Behavior! XOR A-PUF

[Suh et al., DAC’07]

Modeling Attacks

[Ruhrmair et al., CCS’10] [Becker, CHES’15]

Add non-linear funcions Memristor A-PUF

[Suh et al., DAC’15]

Add non-linear components

Physical Attacks

[Merli et al., WESS’11] [Tajik et al., CHES’14] [Rührmair et al., CHES’14]

/ / / 1 1 / / / 1 1 1 / 1 / / 1 1 1 1 1

PUF Security in in Practice

slide-17
SLIDE 17

2004 2008

SELECTED ATTACKS & ANALYSIS

ML-Modeling Attack (A-PUF)

[Lee et al., VLSIC’04]

ML-Modeling Attack (FF A-PUF)

[Majzoobi et al., ITC’08]

2010-2012

ML-Modeling Attack delay-based PUFs

[Ruhrmair et al., CCS’10]

2013 2014

Semi-Invasive EM Attack (RO-PUF)

[Merli et al., WESS’11]

Rémanence Decay SCA (SRAM PUF)

[Oren et al., CHES’13]

Cloning SRAM PUF

[Helfmeier et al., HOST’13]

Semi-Invasive Attack on PUFs

[Nedospasov et al., FDTC’13]

Noise SCA (A-PUF)

[Delvaux et al., HOST’13]

ML-Modeling Attack (Bistable Ring PUF)

[Hesselbarth et al., TRUST’14]

Power&Timing SCA (A-PUF)

[Rührmair et al., CHES’14]

Photon Emission Analysis (A-PUF)

[Tajik et al., CHES’14]

Hybrid Modeling Attacks (Current-based PUF)

[Kumar et al., ICCD’14]

PUFs: Myth, Fact or Busted?

[Katzenbeisser et al., CHES‘12]

Unified Security Model for PUFs

[Armknecht et al., CT-RSA 2016]

Formal Security Model

[Armknecht et al., S&P 2011]

Reliability-based ML-Modeling Attack (XOR A-PUF)

[Becker, CHES’15]

ML-Modeling Attack (Bistable Ring PUF)

[Ganji et al., CHES’16]

ML-Modeling Attack on non-linear PUFs

[Vijaykumar et al., HOST’16]

2015-2018

Hammering RH-PUF

[Zeitouni et al., DAC’18]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-18
SLIDE 18

Example: Arb rbiter PUF

Response Impulse

1

𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕

Challenge Arbiter

Goal: Recovering the values of the wire delays inside the switch boxes

Modeling Attacks (Machine Learning) Physical Attacks (Semi-invasive/Side-channel)

CRPs ≈ 102 CRPs ≈ 103 - 106

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-19
SLIDE 19

Arb rbiter PUF on a Complex Programmable Logic Device (C (CPLD): : Backside Vie iew

Programmable Logic Blocks Placement of an Arbiter PUF with 8 switches Upper Path Lower Path One switch

slide-20
SLIDE 20

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter 𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Response Impulse Challenge 1

slide-21
SLIDE 21

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter Response Impulse Challenge 1

1 0 0 0 0 0 0 0

slide-22
SLIDE 22

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter Response Impulse

Lower path delay 𝑿𝒎 = 𝒖𝟑 − 𝒖𝟏 Upper path delay 𝑿𝒗 = 𝒖𝟐 − 𝒖𝟏

Challenge 1

𝒖𝟏 𝒖𝟐 𝒖𝟑 1 0 0 0 0 0 0 0

slide-23
SLIDE 23

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter 𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Response Impulse

Lower path delay 𝑋

𝑚

Upper path delay 𝑋

𝑣

Challenge 1

C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿𝒗 𝑿𝒎

slide-24
SLIDE 24

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter Response Impulse

Lower path delay 𝑋

𝑚

Upper path delay 𝑋

𝑣

Challenge 1

C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿𝒗 𝑿𝒎 𝒘𝟐 𝒗𝟐

0 0 0 0 0 0 0 0

slide-25
SLIDE 25

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter Response Impulse

Lower path delay 𝑋

𝑚

Upper path delay 𝑋

𝑣

Challenge 1

C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿𝒗 𝑿𝒎 𝒘𝟐 𝒗𝟐 𝒘𝟑 𝒗𝟑

1 0 0 0 0 0 0 0

slide-26
SLIDE 26

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter 𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Response Impulse

Lower path delay 𝑋

𝑚

Upper path delay 𝑋

𝑣

Challenge 1

C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿𝒗 𝑿𝒎 𝒘𝟐 𝒗𝟐 𝒘𝟑 𝒗𝟑

slide-27
SLIDE 27

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter 𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Response Impulse

Lower path delay 𝑋

𝑚

Upper path delay 𝑋

𝑣

Challenge 1

Characterize each switch box in the Arbiter PUF by calculating the delay differences for upper and lower paths

C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿𝒗 𝑿𝒎 𝒘𝟐 𝒗𝟐 𝒘𝟑 𝒗𝟑

slide-28
SLIDE 28

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter 𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Response Impulse

Lower path delay 𝑋

𝑚

Upper path delay 𝑋

𝑣

Challenge 1

Characterize each switch box in the Arbiter PUF by calculating the delay differences for upper and lower paths

C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿𝒗 𝑿𝒎 𝒘𝟐 𝒗𝟐 𝒘𝟑 𝒗𝟑

slide-29
SLIDE 29

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter 𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Response Impulse

Lower path delay 𝑋

𝑚

Upper path delay 𝑋

𝑣

Challenge 1

Characterize each switch box in the Arbiter PUF by calculating the delay differences for upper and lower paths 𝒘𝟐 − 𝒘𝟑 = 𝒙𝟐

𝒗𝟏 − 𝒙𝟏 𝒗𝟏

C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿𝒗 𝑿𝒎 𝒘𝟐 𝒗𝟐 𝒘𝟑 𝒗𝟑

slide-30
SLIDE 30

Physical Attacks: : Example: [T

[Taji jik et t al., l., CH CHES’14]

Switch Arbiter 𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Response Impulse

Lower path delay 𝑋

𝑚

Upper path delay 𝑋

𝑣

Challenge 1

Characterize each switch box in the Arbiter PUF by calculating the delay differences for upper and lower paths 𝒘𝟐 − 𝒘𝟑 = 𝒙𝟐

𝒗𝟏 − 𝒙𝟏 𝒗𝟏

𝒗𝟐 − 𝒗𝟑 = 𝑥1

𝑚0 − 𝑥0 𝑚0

C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿𝒗 𝑿𝒎 𝒘𝟐 𝒗𝟐 𝒘𝟑 𝒗𝟑

slide-31
SLIDE 31

Beyond CMOS-based PUFs

CMOS-based PUFs exhibit linear behavior => vulnerable to machine learning One Solution: Add components with non-linear behavior to complicate/escape machine learning attacks, e.g., Memristors

slide-32
SLIDE 32

Memris istors ∞

  • A resistor that changes it resistance

as voltage is applied

  • Applications:
  • Oscillators
  • Learners (Neural Networks)
  • Memories
  • PUFs!
  • The top (bottom) figure shows

Current-Voltage charcteristics of a memristor (resistor)

Voltage Current

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-33
SLIDE 33

CMOS-based APUF vs. . Memris istor-based APUF

Arbiter 𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Challenge Response Impulse 1 1

∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞

𝒅𝟏 𝒅𝟐 𝒅𝟖 𝒅𝟑 𝒅𝟒 𝒅𝟓 𝒅𝟔 𝒅𝟕 Challenge Impulse Arbiter Response

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-34
SLIDE 34

CMOS-based APUF vs. . Memris istor-based APUF

CMOS-based Arbiter PUF: Voltage at the upper path Memristor-based Arbiter PUF: Voltage at the upper path

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-35
SLIDE 35

Conclu lusio ion

  • Many PUF designs, no unified security model
  • Several successful attacks
  • Non-destructive physical attacks
  • Modeling attacks
  • Designing secure PUFs is challenging?
  • What are the costs?
  • PUFs based on advanced memory technologies
  • E.g., Memristors
slide-36
SLIDE 36

Our Current Work: Framework for Evaluation of f Memristor-based PUFs

slide-37
SLIDE 37

Framework for Evaluation of f Memristor-based PUFs

PUF Circuit Generation Challenge- Response Pairs Generation Analysis of PUF properties: Reproducibility, uniqueness, etc PUF Description Spice PUF circuit CRPs Secure/Insecure PUF Memristor model Advanced Machine Learning

slide-38
SLIDE 38

In Integrated Securit ity Devic ices: The TPM Promise

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-39
SLIDE 39

App 4 I/O

Tru rusted Computing

Operating System App 1 App 2 App 3 TPM Hardware Software Stack Peripherals CPU Memory

  • Authenticated Boot and Attestation

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-40
SLIDE 40

App 4 I/O

Tru rusted Computing

Operating System App 1 App 2 App 3 TPM Hardware Software Stack Peripherals CPU Memory Operating System App 4 App 1 App 2 App 3 Example: IBM Integrity Measurement Architecture (IMA)

  • Authenticated Boot and Attestation

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-41
SLIDE 41

App 4 I/O

Tru rusted Computing

Operating System App 1 App 2 App 3 TPM Hardware Software Stack Peripherals CPU Memory

Runtime attacks (e.g., Code-reuse Attacks)

  • Authenticated Boot and Attestation

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-42
SLIDE 42

Summary ry: : TPM-based Tru rusted Computing

  • Binary hashes express trustworthiness of code
  • Runtime attacks (e.g., code reuse) undermine this assumption
  • Unforgeability of measurements
  • TPM 1.2 uses deprecated SHA1
  • Protection against software attacks only
  • Hardware attacks on TPM

TPM assumptions and shortcomings

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-43
SLIDE 43

Our Current Work: Control-Flow Attestation

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-44
SLIDE 44

Memory

Offline: Control-Flow Graph (CFG) Analysis & Path Measurement

App A

P*x P*2

Online: Runtime Validation

Processor Attestation Engine Hash Controller

Challenge

P1 P2 LP1

Ongoing Work rk: : Towards Run-time Attestation

  • Control Flow Attestation [Davi et al, CCS 2016 & DAC 2017]

Measurement Database

Prover Verifier

Resilient to memory attacks

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-45
SLIDE 45

Trusted Executio ion Envir ironment (TEE)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-46
SLIDE 46

ARM Tru rustZone

Operating System App 1 App 2 App 4 App 3 Hardware Software Stack Peripherals CPU I/O Memory IMEI: International Mobile Equipment Identifier

Assumptions:

  • Apps in Secure World are trustworthy
  • Normal World cannot influence Secure World

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-47
SLIDE 47

ARM Tru rustZone

Hardware Software Stack Peripherals CPU I/O Memory Operating System App 1 App 2 App 3 Secure World Trustlet 1 Trustlet 2 Trustlet 3 Operating System

Android

  • Full-Disk Encryption (FDE)
  • Samsung KNOX
  • Secure-I/O, Attestation
  • Real-time Kernel

Protection (TIMA)

DRM

  • Netflix
  • Spotify
  • Widevine
  • Subsidy Lock
  • IMEI Protection

IMEI: International Mobile Equipment Identifier

Assumptions:

  • Apps in Secure World are trustworthy
  • Normal World cannot influence Secure World

iOS

  • Device Encryption
  • Touch ID, Apple Pay

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-48
SLIDE 48

ARM Tru rustZone

Hardware Software Stack Peripherals CPU I/O Memory Operating System App 1 App 2 App 3 Secure World Trustlet 1 Trustlet 2 Trustlet 3 Operating System IMEI: International Mobile Equipment Identifier

Assumptions:

  • Apps in Secure World are trustworthy
  • Normal World cannot influence Secure World

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-49
SLIDE 49

ARM Tru rustZone

Hardware Software Stack Peripherals CPU I/O Memory Operating System App 1 App 2 App 3 Secure World Trustlet 1 Trustlet 2 Trustlet 3 Operating System Trustlet 1 Trustlet 2 Trustlet 3 Operating System IMEI: International Mobile Equipment Identifier

  • Reflections on trusting TrustZone

[Dan Rosenberg, BlackHat US, 2014]

  • Attacking your Trusted Core

[Di Shen, BlackHat US, 2015]

  • Breaking Android Full Disc Encryption

[laginimaineb from Project Zero, 2016]

Assumptions:

  • Apps in Secure World are trustworthy
  • Normal World cannot influence Secure World

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-50
SLIDE 50

Summary ry: : ARM Tru rustZone

  • ARM TrustZone – Outdated?
  • Deployed for almost two decades
  • Trusted computing for vendors and friends only
  • No access for app developer
  • Many attacks have been shown over the last years
  • On the positive side
  • Secure I/O

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-51
SLIDE 51

Our Current Work: “Arbitrary” Number of TEEs in Normal World on ARM TZ

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-52
SLIDE 52

Intel Software Guard Extensions (SGX)

Operating System App 1 App 2 App 4 App 3 Hardware Software Stack Peripherals CPU I/O Memory Enclave 4 Enclave 3 Enclave 2 Enclave 1

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-53
SLIDE 53

Intel Software Guard Extensions (SGX)

Operating System App 1 App 2 App 4 App 3 Hardware Software Stack Peripherals CPU I/O Memory Enclave 4 Enclave 3 Enclave 2 Enclave 1

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-54
SLIDE 54

Host Application Operating System

SGX (A (Adversary ry) Model

Application N NIC DRAM MMU CPU Attacker Enclave Isolation NIC: Network Interface Controller MMU: Memory Management Unit

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-55
SLIDE 55

Host Application Host Application Operating System

SGX (A (Adversary ry) Model

Application N Operating System NIC DRAM MMU CPU Attacker Enclave Isolation Application N DRAM NIC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

NIC: Network Interface Controller MMU: Memory Management Unit

slide-56
SLIDE 56

Run-time Attacks Inside the Enclave

slide-57
SLIDE 57

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

Source SGX SDK

SGX SDK and The Guard’s Dilemma

App Enclave Function 0 Function 1 Function 2 Function 3 Compiler App Code Untrusted Runtime System (uRTS) Trusted Runtime System (tRTS)

App-to-Enclave function call (ECALL)

[Biondo et al., USENIX Sec. 2018]

slide-58
SLIDE 58

App

SGX SDK and The Guard’s Dilemma

Enclave Function 0 Function 1 Function 2 Function 3 Trusted Runtime System (tRTS) State

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

[Biondo et al., USENIX Sec. 2018]

slide-59
SLIDE 59

App

SGX SDK and The Guard’s Dilemma

Enclave Function 0 Function 1 Function 2 Function 3 Trusted Runtime System (tRTS) Restore State State

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

[Biondo et al., USENIX Sec. 2018]

slide-60
SLIDE 60

App

SGX SDK and The Guard’s Dilemma

Enclave Function 0 Function 1 Function 2 Function 3 Trusted Runtime System (tRTS) Restore State State

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

[Biondo et al., USENIX Sec. 2018]

slide-61
SLIDE 61

App

SGX SDK and The Guard’s Dilemma

Enclave Function 0 Function 1 Function 2 Function 3 Trusted Runtime System (tRTS) Restore State State Counterfeit state

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

[Biondo et al., USENIX Sec. 2018]

slide-62
SLIDE 62

App

SGX SDK and The Guard’s Dilemma

Enclave Function 0 Function 1 Function 2 Function 3 Trusted Runtime System (tRTS) Restore State State Counterfeit state

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

[Biondo et al., USENIX Sec. 2018]

slide-63
SLIDE 63

Leakage in Intel’s SGX

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-64
SLIDE 64

Page Fault lt Attacks on SGX

Enclave 1 Enclave 2 App 1 App 2 App 3 CPU OS EPC RAM

EPC: Enclave Page Cache PT: Page Tables PF: Page-Fault

Granularity: page 4K, good for big data structures

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-65
SLIDE 65

Page Fault lt Attacks on SGX

Enclave 1 Enclave 2 App 1 App 2 App 3 CPU OS EPC RAM PT PT

Granularity: page 4K, good for big data structures

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache PT: Page Tables PF: Page-Fault

slide-66
SLIDE 66

Page Fault lt Attacks on SGX

Enclave 1 Enclave 2 App 1 App 2 App 3 CPU OS EPC RAM PT PT PF Handler IRQ

Granularity: page 4K, good for big data structures

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache PT: Page Tables PF: Page-Fault

slide-67
SLIDE 67

Page Fault lt Attacks on SGX

Enclave 1 Enclave 2 App 1 App 2 App 3 CPU OS EPC RAM PT PT PF Handler IRQ

Granularity: page 4K, good for big data structures

[Xu et al., IEEE S&P’15]

Original Recovered

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache PT: Page Tables PF: Page-Fault

slide-68
SLIDE 68

Page Fault lt Attacks on SGX

Enclave 1 Enclave 2 App 1 App 2 App 3 CPU OS EPC RAM PT PT PF Handler IRQ

Granularity: page 4K, good for big data structures

[Xu et al., IEEE S&P’15]

Original Recovered Single-trace RSA key recovery from RSA key generation

procedure of Intel SGX SSL via controlled-channel attack on the binary Euclidean algorithm (BEA) [Weiser et al., AsiaCCS’18]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache PT: Page Tables PF: Page-Fault

slide-69
SLIDE 69

Cache Attacks on SGX: : Hack in in The Box

Enclave 1 Enclave 2 App 1 App 2 App 3 CPU EPC RAM

EPC: Enclave Page Cache

Cache

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-70
SLIDE 70

Cache Attacks on SGX: : Hack in in The Box

Enclave 1 Enclave 2 App 1 App 2 App 3 CPU EPC RAM

EPC: Enclave Page Cache

Cache

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-71
SLIDE 71

Cache Attacks on SGX: : Hack in in The Box

Enclave 1 Enclave 2 App 1 App 2 App 3 CPU EPC RAM

EPC: Enclave Page Cache

Cache

  • bserve

uses

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-72
SLIDE 72

Sid ide-Channel l Attacks Basic ics: Prim ime + Probe

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-73
SLIDE 73

Cache-based Sid ide-Channel l Attacks

Prim ime + Probe

cache line 0 cache line 1 cache line 2 cache line 4 cache line 3 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5

t0 t1 t2

for each cline Z write(Z) if (keybit[i] == 0) read(X) else read(Y) For each cline Z read(Z) measure_time(read)

Prime Victim Probe

Cache Code cache line 0 cache line 1 cache line 2 cache line 4 cache line 3 cache line 5 cache line 2

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-74
SLIDE 74

Cache-based Sid ide-Channel l Attacks

Prim ime + Probe

cache line 0 cache line 1 cache line 2 cache line 4 cache line 3 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5

t0 t1 t2

for each cline Z write(Z) if (keybit[i] == 0) read(X) else read(Y) For each cline Z read(Z) measure_time(read)

Prime Victim Probe

Cache Code cache line 2

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-75
SLIDE 75

Cache-based Sid ide-Channel l Attacks

Prim ime + Probe

cache line 0 cache line 1 cache line 2 cache line 4 cache line 3 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5

t0 t1 t2

for each cline Z write(Z) if (keybit[i] == 0) read(X) else read(Y) For each cline Z read(Z) measure_time(read)

Prime Victim Probe

Cache Code cache line 2

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-76
SLIDE 76

Cache-based Sid ide-Channel l Attacks

Prim ime + Probe

cache line 0 cache line 1 cache line 2 cache line 4 cache line 3 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5

t0 t1 t2

for each cline Z write(Z) if (keybit[i] == 0) read(X) else read(Y) For each cline Z read(Z) measure_time(read)

Prime Victim Probe

Cache Code cache line 2

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-77
SLIDE 77

Cache-based Sid ide-Channel l Attacks

Prim ime + Probe

cache line 0 cache line 1 cache line 2 cache line 4 cache line 3 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5 cache line 0 cache line 1 cache line 2 cache line 3 cache line 4 cache line 5

t0 t1 t2

for each cline Z write(Z) if (keybit[i] == 0) read(X) else read(Y) For each cline Z read(Z) measure_time(read)

Prime Victim Probe

Cache Code

cache line 2 was used by victim

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-78
SLIDE 78

cl 0

Sid ide-Channel Attacker Challe lenge: Nois ise

  • “Classical” scenario: unprivileged attacker
  • OS* is not collaborating with the attacker
  • OS can directly access process memory containing the victim’s secret
  • System operates normally, impacting the caches (process scheduling,

context switches, interrupts, etc.)

*OS: Operating System and any other privileged system software

cl 0 cl 1 cl 2

Prime tk tl tn

cl 0 cl 1 cl 2 cl 0 cl 1 cl 2

Other Process

cl 0 cl 1 cl 2

Victim

cl 2

tm

cl 0 cl 1 cl 2

Probe

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-79
SLIDE 79

cl 0

Sid ide-Channel Attacker Challe lenge: Nois ise

  • “Classical” scenario: unprivileged attacker
  • OS* is not collaborating with the attacker
  • OS can directly access process memory containing the victim’s secret
  • System operates normally, impacting the caches (process scheduling,

context switches, interrupts, etc.)

*OS: Operating System and any other privileged system software

cl 0 cl 1 cl 2

Prime tk tl tn

cl 0 cl 1 cl 2

Other Process

cl 0 cl 1 cl 2

Victim

cl 2

tm

cl 0 cl 1 cl 2

Probe

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-80
SLIDE 80

cl 0

Sid ide-Channel Attacker Challe lenge: Nois ise

  • “Classical” scenario: unprivileged attacker
  • OS* is not collaborating with the attacker
  • OS can directly access process memory containing the victim’s secret
  • System operates normally, impacting the caches (process scheduling,

context switches, interrupts, etc.)

*OS: Operating System and any other privileged system software

cl 0 cl 1 cl 2

Prime tk tl tn

cl 0 cl 1 cl 2

Other Process

cl 0 cl 1 cl 2

Victim

cl 2

tm

cl 0 cl 1 cl 2

Probe

cl 0

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-81
SLIDE 81

cl 0

Sid ide-Channel Attacker Challe lenge: Nois ise

  • “Classical” scenario: unprivileged attacker
  • OS* is not collaborating with the attacker
  • OS can directly access process memory containing the victim’s secret
  • System operates normally, impacting the caches (process scheduling,

context switches, interrupts, etc.)

*OS: Operating System and any other privileged system software

cl 0 cl 1 cl 2

Prime tk tl tn

cl 0 cl 1 cl 2

Other Process

cl 0 cl 1 cl 2

Victim tm

cl 0 cl 1 cl 2

Probe

cl 0 cl 2

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-82
SLIDE 82

cl 0

Sid ide-Channel Attacker Challe lenge: Nois ise

  • “Classical” scenario: unprivileged attacker
  • OS* is not collaborating with the attacker
  • OS can directly access process memory containing the victim’s secret
  • System operates normally, impacting the caches (process scheduling,

context switches, interrupts, etc.)

*OS: Operating System and any other privileged system software

cl 0 cl 1 cl 2

Prime tk tl tn

cl 0 cl 1 cl 2

Other Process

cl 0 cl 1 cl 2

Victim tm

cl 0 cl 1 cl 2

Probe

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-83
SLIDE 83

cl 0

Sid ide-Channel Attacker Challe lenge: Nois ise

  • “Classical” scenario: unprivileged attacker
  • OS* is not collaborating with the attacker
  • OS can directly access process memory containing the victim’s secret
  • System operates normally, impacting the caches (process scheduling,

context switches, interrupts, etc.)

*OS: Operating System and any other privileged system software

cl 0 cl 1 cl 2

Prime tk tl tn

cl 0 cl 1 cl 2

Other Process

cl 0 cl 1 cl 2

Victim tm

cl 0 cl 1 cl 2

Probe cl0 and cl2 were used… … by the victim?

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-84
SLIDE 84

Cache Attacks on SGX

Enclave 1 Enclave 2 App 2 App 3 CPU EPC RAM Level 3 CPU Core

Level 2 Level 1 Branch Pred. SMT SMT

OS

EPC: Enclave Page Cache SMT: Simultaneous Multithreading

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-85
SLIDE 85

Cache Attacks on SGX

Enclave 1 Enclave 2 App 2 App 3 CPU EPC RAM Level 3 CPU Core

Level 2 Level 1 Branch Pred. SMT SMT

OS

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache SMT: Simultaneous Multithreading

slide-86
SLIDE 86

Cache Attacks on SGX

Enclave 1 Enclave 2 App 2 App 3 CPU EPC RAM Level 3 CPU Core

Level 2 Level 1 Branch Pred. SMT SMT

OS

Use CPU internal caches to infer control flow [Lee et al., Usenix Sec’17] & [arXiv:1611.06952]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache SMT: Simultaneous Multithreading

slide-87
SLIDE 87

Cache Attacks on SGX

Enclave 1 Enclave 2 App 2 App 3 CPU EPC RAM Level 3 CPU Core

Level 2 Level 1 Branch Pred. SMT SMT

OS

Use CPU internal caches to infer control flow [Lee et al., Usenix Sec’17] & [arXiv:1611.06952] Use standard prime + probe to detect key dependent memory accesses, interrupt enclave [Moghimi et al., arXiv:1703.06986] Use prime + probe to extract key from synchronized victim enclave [Götzfried et al., EuroSec’17]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache SMT: Simultaneous Multithreading

slide-88
SLIDE 88

Cache Attacks on SGX

Enclave 1 Enclave 2 App 2 App 3 CPU EPC RAM Level 3 CPU Core

Level 2 Level 1 Branch Pred. SMT SMT

OS

Use CPU internal caches to infer control flow [Lee et al., Usenix Sec’17] & [arXiv:1611.06952] Use standard prime + probe to detect key dependent memory accesses, interrupt enclave [Moghimi et al., arXiv:1703.06986] Use prime + probe to extract key from synchronized victim enclave [Götzfried et al., EuroSec’17] A malicious enclave prime + probes another enclave, evading detection [Schwarz et al., DIMVA’17 & arXiv:1702.08719]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache SMT: Simultaneous Multithreading

slide-89
SLIDE 89

Cache Attacks on SGX

Enclave 1 Enclave 2 App 2 App 3 CPU EPC RAM Level 3 CPU Core

Level 2 Level 1 Branch Pred. SMT SMT

OS

Use CPU internal caches to infer control flow [Lee et al., Usenix Sec’17] & [arXiv:1611.06952] Use standard prime + probe to detect key dependent memory accesses, interrupt enclave [Moghimi et al., arXiv:1703.06986] Use prime + probe to extract key from synchronized victim enclave [Götzfried et al., EuroSec’17] A malicious enclave prime + probes another enclave, evading detection [Schwarz et al., DIMVA’17 & arXiv:1702.08719] Our attack: prime + probe attack from malicious OS extracting genome data [Brasser et al., WOOT’17]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

EPC: Enclave Page Cache SMT: Simultaneous Multithreading

slide-90
SLIDE 90

SGX Sid ide-Channel Attacks Comparison

Attack Type Observed Cache Interrupting Victim Cache Eviction Measurement Attacker Code Attacked Victim Lee et al. Branch Shadowing BTB / LBR Yes Execution Timing OS RSA & SVM classifier Moghimi et al. Prime + Probe L1(D) Yes Access timing OS AES Götzfried et al. Prime + Probe L1(D) No PCM OS AES Our Attack Prime + Probe L1(D) No PCM OS RSA & Genome Sequencing Schwarz et al. Prime + Probe L3 No Counting Thread Enclave AES

PCM: Performance Counter Monitor BTB: Branch Target Buffer LBR: Last Branch Record

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-91
SLIDE 91

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 Core 0 Core n PCM

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-92
SLIDE 92

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 Core 0 Core n PCM

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

slide-93
SLIDE 93

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 Core 0 Core n PCM

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

slide-94
SLIDE 94

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 Core 0 Core n PCM

Modified Linux scheduler to exclude one core (two threads) from assigning task

  • Attacker assigns victim enclave to first SMT thread
  • Attacker assigns Prime+Probe code to second SMT

thread

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

slide-95
SLIDE 95

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 APIC Core 0 Core n Handler Handler Handler Handler PCM

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

slide-96
SLIDE 96

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 APIC Core 0 Core n Handler Handler PCM

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

slide-97
SLIDE 97

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 APIC Core 0 Core n Handler Handler PCM

Use kernel sysfs interface to assign interrupts to other cores

  • Timer interrupt (per thread) cannot be reassigned
  • Lowered timer frequency to 100Hz (i.e., every 10ms)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

slide-98
SLIDE 98

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 APIC Core 0 Core n Handler Handler PCM

Probe

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

slide-99
SLIDE 99

[Brasser et al., WOOT’17]

Our Attack

SMT SMT L1 OS Process 1 Process 2 Victim Process n Attacker Process m Process m+1 SMT SMT L1 APIC Core 0 Core n Handler Handler PCM

Probe Prime+Probe attack using L1 data cache

  • Eviction detection using Performance Counter

Monitor (L1D_REPLACEMENT)

  • Anti Side-Channel Interference (ASCI) not effective,

monitoring cache events of attacker possible

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

PCM: Performance Counter Monitor SMT: Simultaneous Multithreading APIC: Advanced Programmable Interrupt Controller

slide-100
SLIDE 100

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-101
SLIDE 101

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-102
SLIDE 102

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-103
SLIDE 103

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-104
SLIDE 104

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-105
SLIDE 105

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-106
SLIDE 106

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-107
SLIDE 107

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-108
SLIDE 108

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-109
SLIDE 109

Spatial vs. Temporal Resolution

while ( i > 0) { prepare(); x = table[secret]; process(x); } prime() { write_cache(); } wait(); Probe() { test_evic(); } Cache Attacker Victim Enclave PC PC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-110
SLIDE 110

Our Attack Use-Cases

Extracting 2048-bit RSA decryption key Extracting genome sequences

[arXiv:1702.07521]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-111
SLIDE 111

Genome Sequencing

Encrypted Genome Sequence Genome Analysis Enclave (e.g. PRIMEX)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-112
SLIDE 112

Genome Sequencing

Encrypted Genome Sequence Pre-processing

  • Split input into

sub-sequences (k-mer)

  • Store k-mer

positions in hash-table Analysis

  • Statistical

analysis, e.g., to identify correlation in the data Genome Analysis Enclave (e.g. PRIMEX)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-113
SLIDE 113

Genome Sequencing

Encrypted Genome Sequence Pre-processing

  • Split input into

sub-sequences (k-mer)

  • Store k-mer

positions in hash-table Analysis

  • Statistical

analysis, e.g., to identify correlation in the data Genome Analysis Enclave (e.g. PRIMEX) Attacker’s goal: Identify k-mer sequences in the input string, allowing the identification of individuals

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-114
SLIDE 114

Genome Sequencing

Pre-processing

  • Split input into

sub-sequences (k-mer)

  • Store k-mer

positions in hash- table

Analysis

  • Statistical

analysis, e.g., to identify correlation in the data

Genome Analysis Enclave (e.g. PRIMEX)

ATCGATCGATCG…

Attacker’s goal: Identify k-mer sequences in the input string, allowing the identification of individuals

TTGACCCACTGAATCACGTCTG…

Encrypted Genome Sequence

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-115
SLIDE 115

Human Genome

  • Nucleobases
  • Adenine (A)
  • Cytosine (C)
  • Guanine (G)
  • Thymine (T)
  • Microsatellite
  • Forensic analysis
  • Genetic fingerprinting
  • Kinship analysis

TTGACCCACTGAATCACGTCTGACCGCGCGTACGCGG TCACTTGCGGTGCCGTTTTCTTTGTTACCGACGACCG ACCAGCGACAGCCACCGCGCGCTCACTGCCACCAAAA GAGTCATATCGATCGATCGATCGATCGATCGATCGAT CGATCGATCGATCGATCGATCGATCGATCGATCATCA CAGCCGACCAGTTTCTGGAACGTTCCCGATACTGGAA CGGTCCTAATGCAGTATCCCACCCTCCTTCCATCGAC GCCAGTCGAATCACGCCGCCAGCCACCGTCCGCCAGC CGGCCAGAATACCGATGACTCGGCGGTCTCGTGTCGG TGCCGGCCTCGCAGCCATTGTACTGGCCCTGGCCGCA GTGTCGGCTGCCGCTCCGATTGCCGGGGCGCAGTCCG CCGGCAGCGGTGCGGTCTCAGTCACCATCGGCGACGT GGACGTCTCGCCTGCGAACCCAACCACGGGCACGCAG GTGTTGATCACCCCGTCGATCAACAACTCCGGATCGG CAAGCGGGTCCGCGCGCGTCAACGAGGTCACGCTGCG CGGCGACGGTCTCCTCGCAACGGAAGACAGCCTGGGG

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-116
SLIDE 116

… Hash Table Indexer A G C A G C A T C A G G T A C …

Genome Preprocessing

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-117
SLIDE 117

… Hash Table

1

Indexer A G C A G C A T C A G G T A C …

Genome Preprocessing

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-118
SLIDE 118

… Hash Table

1 2

Indexer A G C A G C A T C A G G T A C …

Genome Preprocessing

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-119
SLIDE 119

… Hash Table

3 1 2

Indexer A G C A G C A T C A G G T A C …

Genome Preprocessing

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-120
SLIDE 120

… Hash Table

3 1 2

Indexer

  • Hash table access pattern
  • Hash table entry 8 bytes
  • Cache line size 64 bytes
  • Collisions
  • Genome unstructured
  • Microsatellites structured

A G C A G C A T C A G G T A C …

TTGACCCACTGAATCACGTCTGACCGCGCGTACGCGGTCACTTGC GGTGCCGTTTTCTTTGTTACCGACGACCGACCAGCGACAGCCACC GCGCGCTCACTGCCACCAAAAGAGTCATATCGATCGATCGATCGA TCGATCGATCGATCGATCGATCGATCGATCGATCGATCGATCGAT CATCACAGCCGACCAGTTTCTGGAACGTTCCCGATACTGGAACGG TCCTAATGCAGTATCCCACCCTCCTTCCATCGACGCCAGTCGAAT CACGCCGCCAGCCACCGTCCGCCAGCCGGCCAGAATACCGATGAC TCGGCGGTCTCGTGTCGGTGCCGGCCTCGCAGCCATTGTACTGGC CCTGGCCGCAGTGTCGGCTGCCGCTCCGATTGCCGGGGCGCAGTC CGCCGGCAGCGGTGCGGTCTCAGTCACCATCGGCGACGTGGACGT CTCGCCTGCGAACCCAACCACGGGCACGCAGGTGTTGATCACCCC

Genome Preprocessing

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-121
SLIDE 121

Mic icrosatell llites and Processed k-mers

ATCGATCGATCGATCGATCGATCGATCGATCG ATCG TCGA CGAT GATC ATCG cache line 1 cache cache line 2 cache line 3 cache line 4 cache line 5 cache line 6 cache line 8 cache line 7 cache line 0 The microsatellite will activate cache lines 2, 4, 5 and 0 repeatedly

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-122
SLIDE 122

Genome Sequencing Attack Result lts

Execution Time Activity in all related cache lines

  • Monitor cache lines associated to satellite
  • High activity in cache lines reveal occurrence of satellite in input string

A D B C

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-123
SLIDE 123

SGX

SGX Sid ide Channels & Defenses

SGX Leakage Oracle Caches

  • L1, L2, LLC, LBR

Page-Faults Spectre Obfuscators SC-resilient SW-design (e.g., Scatter-and-Gather) Cache-archichtecture re-design (e.g., Partitioning) Intel TSX (e.g., T-SGX, Déjà Vu, Cloak ) ORAM / Oblivious Execution Leakage Oracle

Enclave

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-124
SLIDE 124

SGX Specific Sid ide-Channel Defenses Usin ing TSX

  • Intel TSX is a hardware mechanism to allow synchronous memory transactions
  • TSX is not available on all SGX-enable processors

TSX: Transactional Synchronization Extensions

TSX T-SGX: Uses TSX to detect enclave interrupt [Shih et al., NDSS’17] Déjà Vu : Uses TSX to detect enclave slowdown [Chen et al., AsiaCCS’17] Cloak: Prime cache before accessing sensitive data [Schuster et al., USENIX 2017]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-125
SLIDE 125

General Hardware-based Sid ide-Channel Defenses

Cache partitioning / coloring Temporal cache isolation Randomized cache mappings

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-126
SLIDE 126

General Hardware-based Sid ide-Channel Defenses

Cache partitioning / coloring Temporal cache isolation Randomized cache mappings

Problems

  • Ineffective on SMT-

enabled systems

Problems

  • Frequency analysis

for randomization secret

Problems

  • Reduces the amount of

cache available to individual software

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-127
SLIDE 127

General Soft ftware-only Sid ide-Channel Defenses

Side-channel resilient software design Monitoring for attack effects Oblivious execution / ORAM

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-128
SLIDE 128

General Soft ftware-only Sid ide-Channel Defenses

Side-channel resilient software design Monitoring for attack effects Oblivious execution / ORAM

Problems

  • Not applicable to all

applications

  • Manual software

hardening required

Problems

  • Requires privileged

entity (not available in SGX model)

Problems

  • Too inefficient, ORAM

metadata needs to be protected as well

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-129
SLIDE 129

Whil ile(leak) { { add_ORAM_layer(); ; }

Memory (RAM / Cache) Enclave

Process(table) { }

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-130
SLIDE 130

Whil ile(leak) { { add_ORAM_layer(); ; }

Memory (RAM / Cache) Enclave

Process(table) { }

ORAM

Process(stash) { }

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-131
SLIDE 131

Whil ile(leak) { { add_ORAM_layer(); ; }

Memory (RAM / Cache) Enclave

Process(table) { }

ORAM

Process(stash) { }

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-132
SLIDE 132

Whil ile(leak) { { add_ORAM_layer(); ; }

Memory (RAM / Cache) Enclave

Process(table) { }

ORAM

Process(stash) { }

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-133
SLIDE 133

Whil ile(leak) { { add_ORAM_layer(); ; }

Memory (RAM / Cache) Enclave

Process(table) { }

ORAM

Process(stash) { }

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-134
SLIDE 134

Whil ile(leak) { { add_ORAM_layer(); ; }

Memory (RAM / Cache) Enclave

Process(table) { }

ORAM

Process(stash) { }

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-135
SLIDE 135

Summary ry: : SGX – All ll Problems Solved?

  • Side channels more drastic than originally thought
  • Current add-on defenses not practical or effective
  • Academic research solutions mostly not deployed
  • Generic software-only side-channel defenses required
  • No security expertise of enclave developers (no annotations)
  • Hardware extensions/features not available in all SGX CPUs

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-136
SLIDE 136

Our Current Work:

Generic Software-only Side-Channel Defenses

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-137
SLIDE 137

Our Current Work rk: Soft ftware-based Sid ide-Channel Mit itigations

RAM Sensitive Array

[Brasser et al., DR. SGX: Hardening SGX Enclaves against Cache Attacks with Data Location Randomization, ArXiv]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-138
SLIDE 138

Our Current Work rk: Soft ftware-based Sid ide-Channel Mit itigations

RAM Sensitive Array ORAM Tree

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

[Brasser et al., DR. SGX: Hardening SGX Enclaves against Cache Attacks with Data Location Randomization, ArXiv]

slide-139
SLIDE 139

Our Current Work rk: Soft ftware-based Sid ide-Channel Mit itigations

RAM Sensitive Array AES Key

  • DR. SGX

(Pseudo-random Permutation)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

[Brasser et al., DR. SGX: Hardening SGX Enclaves against Cache Attacks with Data Location Randomization, ArXiv]

slide-140
SLIDE 140

DR.S .SGX Re-randomization

Initial layout Layout 1 Layout 2 A B C D E F G H F C G E D H A B G D B E H A F C Time Permutation π1 AES-NI Permutation π2 AES-NI Re-randomization window

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-141
SLIDE 141

Meltdown and Spectre

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-142
SLIDE 142

So, you might have noticed...

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-143
SLIDE 143

So, you might have noticed...

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-144
SLIDE 144

So, you might have noticed...

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-145
SLIDE 145

So, you might have noticed...

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-146
SLIDE 146

So, you might have noticed...

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-147
SLIDE 147

Three Attacks

  • CVE-2017-5754 (aka. Meltdown)
  • Exploits rogue data-cache loads during speculative execution
  • CVE-2017-5753 (aka. Spectre)
  • Exploits bounds-check bypasses during speculative execution
  • CVE-2017-5715 (aka. Spectre)
  • Exploits branch-target injection during speculative execution

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-148
SLIDE 148

Intel Inside Bug inside Speculative Execution!

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-149
SLIDE 149

Speculative Execution? Sounds fi fishy.. ..

And what is a processor anyways?

Processor:

ADD READ WRITE

Input:

Code:

READ 0xA READ 0xB ADD WRITE 0xA

Data:

17 42

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-150
SLIDE 150

Speculative Execution? Sounds fi fishy.. ..

And what is a processor anyways?

Processor:

ADD READ WRITE

Output:

Code:

READ 0xA READ 0xB ADD WRITE 0xC

Input:

:0xC :0xD :0xE :0xF

Data:

17 42 :0xA :0xB

Code:

READ 0xA READ 0xB ADD WRITE 0xA 0xC: 0xD: 0xE: 0xF:

Data:

17 42 0xA: 0xB:

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-151
SLIDE 151

Speculative Execution? Sounds fi fishy.. ..

And what is a processor anyways?

Processor:

ADD READ WRITE

Output:

Code:

READ 0xA READ 0xB ADD WRITE 0xC Program Counter (PC):

Input:

:0xC :0xD :0xE :0xF

Data:

17 42 :0xA :0xB

Code:

READ 0xA READ 0xB ADD WRITE 0xA 0xC: 0xD: 0xE: 0xF:

Data:

17 42 0xA: 0xB: 0xC

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-152
SLIDE 152

Speculative Execution? Sounds fi fishy.. ..

And what is a processor anyways?

Processor:

ADD READ WRITE

Output:

Code:

READ 0xA READ 0xB ADD WRITE 0xC Program Counter (PC):

Input:

:0xC :0xD :0xE :0xF

Data:

17 42 :0xA :0xB

Code:

READ 0xA READ 0xB ADD WRITE 0xA 0xC: 0xD: 0xE: 0xF:

Data:

17 42 0xA: 0xB: 0xC 17

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-153
SLIDE 153

0xD

Speculative Execution? Sounds fi fishy.. ..

And what is a processor anyways?

Processor:

ADD READ WRITE

Output:

Code:

READ 0xA READ 0xB ADD WRITE 0xC Program Counter (PC):

Input:

:0xC :0xD :0xE :0xF

Data:

17 42 :0xA :0xB

Code:

READ 0xA READ 0xB ADD WRITE 0xA 0xC: 0xD: 0xE: 0xF:

Data:

17 42 0xA: 0xB: 17 42

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-154
SLIDE 154

Speculative Execution? Sounds fi fishy.. ..

And what is a processor anyways?

Processor:

ADD READ WRITE

Output:

Code:

READ 0xA READ 0xB ADD WRITE 0xC Program Counter (PC):

Input:

:0xC :0xD :0xE :0xF

Data:

17 42 :0xA :0xB

Code:

READ 0xA READ 0xB ADD WRITE 0xA 0xC: 0xD: 0xE: 0xF:

Data:

17 42 0xA: 0xB: 0xD 17 42 59

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-155
SLIDE 155

Speculative Execution? Sounds fi fishy.. ..

And what is a processor anyways?

Processor:

ADD READ WRITE

Output:

Code:

READ 0xA READ 0xB ADD WRITE 0xC Program Counter (PC):

Input:

:0xC :0xD :0xE :0xF

Data:

17 42 :0xA :0xB

Code:

READ 0xA READ 0xB ADD WRITE 0xA 0xC: 0xD: 0xE: 0xF:

Data:

17 42 0xA: 0xB: 0xE 0xF 59 59

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-156
SLIDE 156

Some operations are SLOOOOOOOW

  • Two read operations can easily stall the CPU for more than 100ns
  • An integer addition takes two orders of magnitude less time (~1ns)
  • So, in the time domain the execution looks like this:
  • Processor does NOTHING for 100ns!

READ 0xA READ 0xB ADD … 50ns 50ns 1ns …

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-157
SLIDE 157

Optimizing for Performance..

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

Instruction Stream:

FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-158
SLIDE 158

Optimizing for Performance..

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

MEMORY ACCESS

Instruction Stream:

Why should I wait for a long time? FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-159
SLIDE 159

Optimizing for Performance..

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

ALU ALU ALU

Instruction Stream:

What happens if I just continue.. FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-160
SLIDE 160

Optimizing for Performance..

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

ALU ALU ALU

Instruction Stream:

FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

MEMORY ACCESS Looks like we are ready!

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-161
SLIDE 161

Optimizing for Performance..

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

ALU ALU ALU

Instruction Stream:

FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

MEMORY ACCESS Looks like we are ready! Ok, result looks good. You can leave early today.

Commit!

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-162
SLIDE 162

Optimizing for Performance..

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

ALU ALU ALU

Instruction Stream:

FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

MEMORY ACCESS

To Boost Performance Modern Processors Execute Instructions Out-of-Order!

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-163
SLIDE 163

.. ..what if if it it does not work?

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

MEMORY ACCESS

Instruction Stream:

Why should I wait for a long time? FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-164
SLIDE 164

.. ..what if if it it does not work?

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

ALU ALU ALU

Instruction Stream:

What happens if I just continue.. FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-165
SLIDE 165

.. ..what if if it it does not work?

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

ALU ALU ALU

Instruction Stream:

FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

MEMORY ACCESS Maybe nobody will notice..

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-166
SLIDE 166

.. ..what if if it it does not work?

Out-of-Order Execution:

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

ALU ALU ALU

Instruction Stream:

FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

MEMORY ACCESS Maybe nobody will notice.. Do it in

  • rder,

stupid!

Rollback!

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-167
SLIDE 167

.. ..what if if it it does not work?

SLOW OP

(e.g., Memory Access or Branch)

FAST OP

(e.g., ALU)

Instruction Stream:

FAST OP

(e.g., ALU)

FAST OP

(e.g., ALU)

MEMORY ACCESS

Only correct optimizations are commited!

ALU ALU ALU

In Order Execution:

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-168
SLIDE 168

Out-of

  • f-Order vs.

. Speculative Execution

  • If the instruction that is re-ordered is a branching instruction, the

resulting Out-of-Order stream is called Speculative Execution

CONDITIONAL BRANCH … … … …

  • Many processors do not optimize this
  • Bigger processors invest a lot of work

into optimizing branches!

  • Simple optimization:
  • Always execute both branches
  • only commit the correct one

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-169
SLIDE 169

What could possibly go go wrong?

OoO-Processor:

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: MOV $ebx, [0x8]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-170
SLIDE 170

What could possibly go go wrong?

OoO-Processor:

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-171
SLIDE 171

What could possibly go go wrong?

OoO-Processor:

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-172
SLIDE 172

What could possibly go go wrong?

OoO-Processor:

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx] 1F 20 2A 2B

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-173
SLIDE 173

What could possibly go go wrong?

OoO-Processor:

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx] Access not allowed, stupid! 1F 20 2A 2B

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-174
SLIDE 174

What could possibly go go wrong?

OoO-Processor:

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx] Access not allowed, stupid! 1F 20 2A 2B

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-175
SLIDE 175

What could possibly go go wrong?

OoO-Processor:

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: Access not allowed, stupid!

Rollback!

1F 20 2A 2B

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-176
SLIDE 176

What could possibly go go wrong?

OoO-Processor:

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: OS memory is none of your business! EXCEPTION 1F 20 2A 2B

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-177
SLIDE 177

What could possibly go go wrong?

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 1F 20 2A 2B :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C: [FLUSH+RELOAD]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018

slide-178
SLIDE 178

What could possibly go go wrong?

User Memory:

0A 0B 0C 0D 0E 0F 10 1A 1B 1C 1D 1E 1F 20 2A 2B :0x70 :0x74 :0x78 :0x7C

Cache:

00 00 00 00 00 00 00 00 00 00 00 00 1F 20 2A 2B :0x0 :0x4 :0x8 :0xC

Code:

MOV $ebx, [0x8] TEST $ebx, $ebx JE Code MOV 0x70, [0x70+$ebx]

OS Memory:

0A 0B 0C 0D 0E 0F 10 1A 00 00 00 0C 1F 20 2A 2B 0x70: 0x74: 0x78: 0x7C:

  • well well what do we have here..
  • Memory access happened at 0x7C
  • Actually, my start address was 0x70
  • The value at 0x8 must have been:

0x7C-0x70 = 0x0C! [FLUSH+RELOAD]

Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11–15, 2018