ATTACK AGAINST CONSTANT-TIME CRYPTO IMPLEMENTATIONS IN SGX Daniel - - PowerPoint PPT Presentation

▶
attack against constant time
SMART_READER_LITE
LIVE PREVIEW

ATTACK AGAINST CONSTANT-TIME CRYPTO IMPLEMENTATIONS IN SGX Daniel - - PowerPoint PPT Presentation

Dec 22, 2022 284 likes •786 views

#RSAC SESSION ID: CRYP-T07 MEMJAM: A FALSE DEPENDENCY ATTACK AGAINST CONSTANT-TIME CRYPTO IMPLEMENTATIONS IN SGX Daniel Moghimi Ph.D. Student Worcester Polytechnic Institute @danielmgmi MemJam: A False Dependency Attack against

slide-1
SLIDE 1

SESSION ID: #RSAC

Daniel Moghimi

MEMJAM: A FALSE DEPENDENCY ATTACK AGAINST CONSTANT-TIME CRYPTO IMPLEMENTATIONS IN SGX

CRYP-T07

Ph.D. Student Worcester Polytechnic Institute @danielmgmi

slide-2
SLIDE 2

MemJam: A False Dependency Attack against Constant-Time Crypto Implementations in SGX

Ahmad “Daniel” Moghimi Thomas Eisenbarth Berk Sunar April 17, 2018 CT-RSA 2018 - San Francisco, CA

slide-3
SLIDE 3

Data Dependency

  • Data dependency: Instruction  Data of a preceding instruction

add %ebx, %eax sub %eax, %edx xor %ecx, %ecx add %eax, %edi sub %ecx, %edi

1 2 3 4 5 3

slide-4
SLIDE 4

Data Dependency – Pipelined Execution

  • Data dependency: Instruction  Data of a preceding instruction

add %ebx, %eax sub %eax, %edx xor %ecx, %ecx add %eax, %edi sub %ecx, %edi

1 2 3 4 5 IF ID EX WB

Instruction Fetch Instruction Decode Execute Write Back

4

slide-5
SLIDE 5

Data Dependency – Pipelined Execution

  • Data dependency: Instruction  Data of a preceding instruction

add %ebx, %eax sub %eax, %edx xor %ecx, %ecx add %eax, %edi sub %ecx, %edi

1 2 3 4 5 IF ID EX WB

Instruction Fetch Instruction Decode Execute Write Back

IF 5

slide-6
SLIDE 6

Data Dependency – Pipelined Execution

  • Data dependency: Instruction  Data of a preceding instruction

add %ebx, %eax sub %eax, %edx xor %ecx, %ecx add %eax, %edi sub %ecx, %edi

1 2 3 4 5 IF ID EX WB

Instruction Fetch Instruction Decode Execute Write Back

IF IF ID 6

slide-7
SLIDE 7

Data Dependency – Pipelined Execution

  • Data dependency: Instruction  Data of a preceding instruction

add %ebx, %eax sub %eax, %edx xor %ecx, %ecx add %eax, %edi sub %ecx, %edi

1 2 3 4 5 IF ID EX WB

Instruction Fetch Instruction Decode Execute Write Back

IF IF ID EX ID IF 7

slide-8
SLIDE 8

Data Dependency – Pipelined Execution

  • Data dependency: Instruction  Data of a preceding instruction

add %ebx, %eax sub %eax, %edx xor %ecx, %ecx add %eax, %edi sub %ecx, %edi

1 2 3 4 5 IF ID EX WB

Instruction Fetch Instruction Decode Execute Write Back

IF IF ID EX ID IF WB EX ID IF 8

slide-9
SLIDE 9

Data Dependency – Pipelined Execution

  • Data dependency: Instruction  Data of a preceding instruction

add %ebx, %eax sub %eax, %edx xor %ecx, %ecx add %eax, %edi sub %ecx, %edi

1 2 3 4 5 IF ID EX WB

Instruction Fetch Instruction Decode Execute Write Back

IF IF ID EX ID IF WB EX ID IF EX EX ID IF WB ID WB EX EX WB WB 9

slide-10
SLIDE 10

Data False Dependency

  • Pipeline stalls without true dependency.
  • Reasons:
  • Register Reuse
  • Limited Address Space

add %ebx, %eax xor %ecx, %ecx sub %eax, %edx mov $100, %edx sub %edx, %ecx

1 2 3 4 5

FD

10

slide-11
SLIDE 11

Data False Dependency – Register Renaming

  • Pipeline stalls without true dependency.
  • Reasons:
  • Register Reuse
  • Limited Address Space

add %ebx, %eax xor %ecx, %ecx sub %eax, %edx mov $100, %edx sub %edx, %ecx

1 2 3 4 5

FD

add %ebx, %eax xor %ecx, %ecx sub %eax, %edx mov $100, %bat sub %bat, %ecx

1 2 3 4 5

Register Renaming

11

slide-12
SLIDE 12

Memory ry False Dependency – 4K Aliasing

  • Memory loads/stores are executed out of order and speculatively.
  • The dependency is verified after the execution!
  • 4K Aliasing: Addresses that are 4K apart are assumed dependent.
  • Re-execute the load and corresponding instructions due to false dependency.
  • Virtual-to-physical address translation  Memory disambiguation

mov %eax, (%ebx) mov (%ecx), %edx

Load Store

Execute

Load

Execute

Store

Dependent?

Yes

12

slide-13
SLIDE 13

4K Aliasing – Hyperthreading

Core HT – Thread A HT – Thread B Load 0xFECD1

13

slide-14
SLIDE 14

4K Aliasing – Hyperthreading

Core HT – Thread A HT – Thread B Load 0xFECD1 Load 0xFECD2 Load 0xFECD3 Load 0xFECD4 Load 0xFECD5 Load 0xFECD6 Load 0xFECD7 Load 0xFECD8

14

slide-15
SLIDE 15

4K Aliasing – Hyperthreading

Core HT – Thread A HT – Thread B Load 0xFECD1 Load 0xFECD2 Load 0xFECD3 Load 0xFECD4 Load 0xFECD5 Load 0xFECD6 Load 0xFECD7 Load 0xFECD8 Execute & Time

15

slide-16
SLIDE 16

4K Aliasing – Hyperthreading

Core HT – Thread A HT – Thread B Load 0xFECD1 Load 0xFECD2 Load 0xFECD3 Load 0xFECD4 Load 0xFECD5 Load 0xFECD6 Load 0xFECD7 Load 0xFECD8 Execute & Time Store 0x12ABCDEF Store 0x12ABCDEF Store 0x12ABCDEF Store 0x12ABCDEF Store 0x12ABCDEF Store 0x12ABCDEF Store 0x12ABCDEF Store 0x12ABCDEF Store 0x12ABCDEF Store 0x12ABCDEF

16

slide-17
SLIDE 17

4K Aliasing – Hyperthreading

Core HT – Thread A HT – Thread B Load 0xFECD1 Load 0xFECD2 Load 0xFECD3 Load 0xFECD4 Load 0xFECD5 Load 0xFECD6 Load 0xFECD7 Load 0xFECD8 Execute & Time Store 0x12ABC200 Store 0x12ABC200 Store 0x12ABC200 Store 0x12ABC200 Store 0x12ABC200 Store 0x12ABC200 Store 0x12ABC200 Store 0x12ABC200 Store 0x12ABC200 Store 0x12ABC200

17

slide-18
SLIDE 18

4K Aliasing – Hyperthreading

Core HT – Thread A HT – Thread B Load 0xFECD1 Load 0xFECD2 Load 0xFECD3 Load 0xFECD4 Load 0xFECD5 Load 0xFECD6 Load 0xFECD7 Load 0xFECD8 Execute & Time Store 0x12ABC Store 0x12ABC Store 0x12ABC Store 0x12ABC Store 0x12ABC Store 0x12ABC Store 0x12ABC Store 0x12ABC Store 0x12ABC Store 0x12ABC

18

slide-19
SLIDE 19

MemJam – In

Intra Cache Lin ine Resolution

19

Least 12 bits (Virtual Address = Physical Address) Rest of the bits (Virtual != Physical)

slide-20
SLIDE 20

MemJam – In

Intra Cache Lin ine Resolution

20

Least 12 bits (Virtual Address = Physical Address) Rest of the bits (Virtual != Physical) L1 Cache Attacks

slide-21
SLIDE 21

MemJam – In

Intra Cache Lin ine Resolution

21

Least 12 bits (Virtual Address = Physical Address) Rest of the bits (Virtual != Physical) L1 Cache Attacks L2/LLC Cache Attacks

slide-22
SLIDE 22

MemJam – In

Intra Cache Lin ine Resolution

22

Least 12 bits (Virtual Address = Physical Address) Rest of the bits (Virtual != Physical) L1 Cache Attacks L2/LLC Cache Attacks

2015 – Irazoqui – S $ A 2014 – Yarom – Flush+Reload

2005 – Percival – Cache Missing for Fun 2006 – Osvik – Cache attacks

slide-23
SLIDE 23

MemJam – In

Intra Cache Lin ine Resolution

23

Least 12 bits (Virtual Address = Physical Address) Rest of the bits (Virtual != Physical) L1 Cache Attacks L2/LLC Cache Attacks

  • Intra-cache line Leakage (4-byte granularity)
  • Higher time correlates Memory accesses with the same bit 3 to 12
  • 4 bits of intra-cache level leakage
slide-24
SLIDE 24

MemJam Attack

CPU

Core HT HT Core HT HT Encryption Service

24

slide-25
SLIDE 25

MemJam Attack

CPU

Core HT HT Core HT HT Encryption Service

25

slide-26
SLIDE 26

MemJam Attack

CPU

Core HT HT Core HT HT Encryption Service

26

slide-27
SLIDE 27

MemJam Attack

CPU

Core HT HT Core HT HT Encryption Service

load compute load load compute load compute load load

Execute

27

slide-28
SLIDE 28

MemJam Attack

CPU

Core HT HT Core HT HT Encryption Service

load compute load load compute load compute load load

Execute

28

slide-29
SLIDE 29

MemJam Attack

CPU

Core HT HT Core HT HT Encryption Service

load compute load load compute load compute load load

Execute Execute Again

29

slide-30
SLIDE 30

MemJam Attack

CPU

Core HT HT Core HT HT Encryption Service

load compute load load compute load compute load load

Execute Execute Again

30

slide-31
SLIDE 31

MemJam Attack

CPU

Core HT HT Core HT HT Encryption Service

load compute load load compute load compute load load

Execute Execute Again Higher time if there are more number of 4K conflicts

31

slide-32
SLIDE 32

Constant tim ime AES – Safe2Encry rypt_RIJ128

  • Scatter-gather implementation of AES
  • 256 S-Box – 4 Cache Line
  • Cache independent access pattern
  • Implemented and distributed as part of Intel products
  • Intel SGX Linux Software Development Kit (SDK)
  • Intel IPP Cryptography Library

32

LINE 2 A LINE 2 B LINE 2 C LINE 2 D 64 Bytes 4 Cache Lines S-Box Lookup

slide-33
SLIDE 33

Constant tim ime AES – Safe2Encry rypt_RIJ128

  • Scatter-gather implementation of AES
  • 256 S-Box – 4 Cache Line
  • Cache independent access pattern
  • Implemented and distributed as part of Intel products
  • Intel SGX Linux Software Development Kit (SDK)
  • Intel IPP Cryptography Library

33

LINE 2 A LINE 2 B LINE 2 C LINE 2 D 64 Bytes 4 Cache Lines S-Box Lookup A B C

Local Buffer

D

slide-34
SLIDE 34

Constant tim ime AES – Safe2Encry rypt_RIJ128

  • Scatter-gather implementation of AES
  • 256 S-Box – 4 Cache Line
  • Cache independent access pattern
  • Implemented and distributed as part of Intel products
  • Intel SGX Linux Software Development Kit (SDK)
  • Intel IPP Cryptography Library

34

LINE 2 A LINE 2 B LINE 2 C LINE 2 D 64 Bytes 4 Cache Lines S-Box Lookup A B C

Local Buffer

D B

slide-35
SLIDE 35

MemJam Attack on AES

35

LINE 2 LINE 2 LINE 2 LINE 2 64 Bytes 4 Cache Lines

slide-36
SLIDE 36

MemJam Attack on AES

36

LINE 2 LINE 2 LINE 2 LINE 2 64 Bytes 4 Cache Lines

slide-37
SLIDE 37

MemJam Attack on AES

37

LINE 2 LINE 2 LINE 2 LINE 2 64 Bytes 4 Cache Lines

slide-38
SLIDE 38

MemJam Attack on AES

38

LINE 2 64 Bytes 4 Cache Lines

slide-39
SLIDE 39

MemJam Attack on AES

39

LINE 2 64 Bytes 4 Cache Lines

slide-40
SLIDE 40

AES Key Recovery ry

40

slide-41
SLIDE 41

AES Key Recovery ry

41

slide-42
SLIDE 42

SM4 Blo lock cip ipher – cpSMS4_Cipher

  • Standard Cipher support by Intel
  • Chinese National Standard for Wireless LAN WAPI
  • S-Box + Unbalanced Feistel Structure
  • Protected by Cache State Normalization
  • Recursive attack  Full key recovery with 40K observations

42

slide-43
SLIDE 43

CPU

Intel SGX Enclave

MemJaming In Intel SGX Secure Enclave

Core HT HT Core HT HT Encryption Service

load compute load load compute load compute load load

Execute Execute Again Higher time if there are more number of 4K conflicts

43

slide-44
SLIDE 44

In Intel SGX – AES Key Recovery ry

44

slide-45
SLIDE 45

Conclusion

45

  • New Side-Channel Attack Applicable to all Intel Processors
  • Intel SGX extensions
  • Bypass of Constant-Time Implementations Techniques
  • Scatter-Gather
  • Cache State Normalization
  • Agnostic to other Cache Attack Defense Mechanism
  • Intel Trilogy
  • Intel Hardware
  • Intel Trusted Execution Environment
  • Intel Hardened Crypto Implementation
slide-46
SLIDE 46

Responsible Dis isclosure

46

Date Progress 08/02/2017 Reported 08/04/2017 Acknowledged 11/07/2017 Safe2Encrypt_RIJ128 got removed from SGX SDK. 11/17/2017 CVE-2017-5737 Assigned work-in-progress Patch

slide-47
SLIDE 47

Questions?!

Vernam Group v.wpi.edu @VernamGroup @danielmgmi

47

slide-48
SLIDE 48

48

slide-49
SLIDE 49

49