constant time programming in fact
play

Constant-time programming in FaCT Sunjay Cauligi , UC San Diego - PowerPoint PPT Presentation

Jul 16, 2023 •482 likes •1.63k views

Constant-time programming in FaCT Sunjay Cauligi , UC San Diego Fraser Brown, Ranjit Jhala, Brian Johannesmeyer, John Renner, Gary Soeller, Deian Stefan, Riad Wahby Timing side channels Crypto Constant-time programming with FaCT Strange Loop

  1. Padding removal: 1st try int32_t remove_padding( int32_t remove_padding2( uint8_t* buf, uint8_t* buf, uint32_t buflen) { uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint8_t padlen = buf[buflen-1]; uint32_t i; uint32_t i; for (i = 0; i < padlen; i++) { for (i = 0; i < padlen; i++) { if (buf[buflen-i-1] != padlen) if (buf[buflen-i-1] != padlen) return -1; ok = 0; buf[buflen-i-1] = 0; buf[buflen-i-1] = 0; } } return padlen; return ok ? padlen : -1; } } 10μs 10μs 53 74 ... 4c 6f 6f 70 05 05 07 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  2. Padding removal: 1st try int32_t remove_padding( int32_t remove_padding2( uint8_t* buf, uint8_t* buf, uint32_t buflen) { uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint8_t padlen = buf[buflen-1]; uint32_t i; uint32_t i; for (i = 0; i < padlen; i++) { for (i = 0; i < padlen; i++) { if (buf[buflen-i-1] != padlen) if (buf[buflen-i-1] != padlen) return -1; ok = 0; buf[buflen-i-1] = 0; buf[buflen-i-1] = 0; } } return padlen; return ok ? padlen : -1; } } 10μs 10μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 00 00 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  3. Padding removal: 2nd try int32_t remove_padding2( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = 0; i < padlen; i++) { if (buf[buflen-i-1] != padlen) ok = 0; buf[buflen-i-1] = 0; } return ok ? padlen : -1; } 53 74 ... 4c 6f 6f 70 05 05 05 05 05 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  4. Padding removal: 2nd try int32_t remove_padding2( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = 0; i < padlen; i++) { if (buf[buflen-i-1] != padlen) ok = 0; buf[buflen-i-1] = 0; } return ok ? padlen : -1; } 53 74 ... 4c 6f 6f 70 05 05 05 05 05 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  5. Padding removal: 2nd try int32_t remove_padding2( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = 0; i < padlen; i++) { if (buf[buflen-i-1] != padlen) ok = 0; buf[buflen-i-1] = 0; } return ok ? padlen : -1; } 53 74 ... 4c 6f 6f 70 31 38 03 03 03 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  6. Padding removal: 2nd try int32_t remove_padding2( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = 0; i < padlen; i++) { if (buf[buflen-i-1] != padlen) ok = 0; buf[buflen-i-1] = 0; } return ok ? padlen : -1; } 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  7. Padding removal: 2nd try int32_t remove_padding2( uint8_t* buf, It’s dangerous to uint32_t buflen) { bound loops with secrets! uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for ( i = 0; i < padlen; i++) { if (buf[buflen-i-1] != padlen) ok = 0; buf[buflen-i-1] = 0; Use this instead. } return ok ? padlen : -1; } 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  8. Padding removal: 2nd try int32_t remove_padding3( uint8_t* buf, int32_t remove_padding2( uint32_t buflen) { uint8_t* buf, uint8_t ok = 1; uint32_t buflen) { uint8_t padlen = buf[buflen-1]; uint8_t ok = 1; uint32_t i; for ( i = buflen-255; i < buflen; i++) { uint8_t padlen = buf[buflen-1]; uint8_t b = buf[i]; uint32_t i; if (i >= buflen - padlen) { for (i = 0; i < padlen; i++) { if (b != padlen) if (buf[buflen-i-1] != padlen) ok = 0; ok = 0; b = 0; buf[buflen-i-1] = 0; } } buf[i] = b; return ok ? padlen : -1; } } return ok ? padlen : -1; } 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  9. Padding removal: 2nd try int32_t remove_padding3( uint8_t* buf, int32_t remove_padding2( uint32_t buflen) { uint8_t* buf, uint8_t ok = 1; uint32_t buflen) { uint8_t padlen = buf[buflen-1]; uint8_t ok = 1; uint32_t i; for (i = buflen-255; i < buflen; i++) { uint8_t padlen = buf[buflen-1]; uint8_t b = buf[i]; uint32_t i; if (i >= buflen - padlen) { for (i = 0; i < padlen; i++) { if (b != padlen) if (buf[buflen-i-1] != padlen) ok = 0; ok = 0; b = 0; buf[buflen-i-1] = 0; } } buf[i] = b; return ok ? padlen : -1; } } return ok ? padlen : -1; } 10μs 10μs 10μs 10μs 10μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  10. Padding removal: 3rd try int32_t remove_padding3( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; if (i >= buflen - padlen) { if (b != padlen) ok = 0; b = 0; } buf[i] = b; } return ok ? padlen : -1; } 10μs 10μs 10μs 10μs 10μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  11. Padding removal: 3rd try int32_t remove_padding3( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; if (i >= buflen - padlen) { if (b != padlen) ok = 0; b = 0; } buf[i] = b; } return ok ? padlen : -1; } 10μs 10μs 10μs 10μs 10μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  12. Padding removal: 3rd try int32_t remove_padding3( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; if (i >= buflen - padlen) { if (b != padlen) ok = 0; b = 0; } buf[i] = b; } return ok ? padlen : -1; } 10μs 10μs 10μs 10μs 10μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  13. Padding removal: 3rd try int32_t remove_padding3( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; if (i >= buflen - padlen) { if (b != padlen) ok = 0; b = 0; } buf[i] = b; } return ok ? padlen : -1; } 10μs 10μs 10μs 10μs 10μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  14. Padding removal: 3rd try int32_t remove_padding3( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; if (i >= buflen - padlen) { if (b != padlen) ok = 0; b = 0; } buf[i] = b; } return ok ? padlen : -1; } 10μs 10μs 10μs 10μs 10μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  15. Padding removal: 3rd try int32_t remove_padding3( uint8_t* buf, uint32_t buflen) { uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint32_t i; for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; if (i >= buflen - padlen) { if (b != padlen) ok = 0; b = 0; } buf[i] = b; } return ok ? padlen : -1; } 9μs 9μs 9μs 9μs 9μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  16. Padding removal: 3rd try int32_t remove_padding3( uint8_t* buf, uint32_t buflen) { It’s dangerous to uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; have branching code! uint32_t i; for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; if (i >= buflen - padlen) { if (b != padlen) ok = 0; b = 0; } Use this instead. buf[i] = b; } return ok ? padlen : -1; } 9μs 9μs 9μs 9μs 9μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  17. Padding removal: 3rd try int32_t remove_padding4( int32_t remove_padding3( uint8_t* buf, uint8_t* buf, uint32_t buflen) { uint32_t buflen) { uint32_t ok = -1; uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint8_t padlen = buf[buflen-1]; uint32_t i; uint32_t i; for (i = buflen-255; i < buflen; i++) { for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint8_t b = buf[i]; uint32_t improper_index = if (i >= buflen - padlen) { -(i - (buflen - padlen) >> 31); if (b != padlen) uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); ok = 0; ok &= matches_pad | improper_index; b = 0; b = improper_index & b; } buf[i] = b; buf[i] = b; } } return (ok & padlen) | ~ok; return ok ? padlen : -1; } } 9μs 9μs 9μs 9μs 9μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  18. Padding removal: 3rd try int32_t remove_padding4( int32_t remove_padding3( uint8_t* buf, uint8_t* buf, uint32_t buflen) { uint32_t buflen) { uint32_t ok = -1; uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint8_t padlen = buf[buflen-1]; uint32_t i; Ugly! Do not read! uint32_t i; for (i = buflen-255; i < buflen; i++) { for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint8_t b = buf[i]; uint32_t improper_index = if (i >= buflen - padlen) { -(i - (buflen - padlen) >> 31); if (b != padlen) uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); ok = 0; ok &= matches_pad | improper_index; b = 0; b = improper_index & b; } buf[i] = b; buf[i] = b; } } return (ok & padlen) | ~ok; return ok ? padlen : -1; } } 9μs 9μs 9μs 9μs 9μs 10μs 10μs 10μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  19. Padding removal: 3rd try int32_t remove_padding4( int32_t remove_padding3( uint8_t* buf, uint8_t* buf, uint32_t buflen) { uint32_t buflen) { uint32_t ok = -1; uint8_t ok = 1; uint8_t padlen = buf[buflen-1]; uint8_t padlen = buf[buflen-1]; uint32_t i; Ugly! Do not read! uint32_t i; for (i = buflen-255; i < buflen; i++) { for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint8_t b = buf[i]; uint32_t improper_index = if (i >= buflen - padlen) { -(i - (buflen - padlen) >> 31); if (b != padlen) uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); ok = 0; ok &= matches_pad | improper_index; b = 0; b = improper_index & b; } buf[i] = b; buf[i] = b; } } return (ok & padlen) | ~ok; return ok ? padlen : -1; } } 12μs 12μs 12μs 12μs 12μs 12μs 12μs 12μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  20. Padding removal: 4th try int32_t remove_padding4( uint8_t* buf, uint32_t buflen) { uint32_t ok = -1; ! d a uint8_t padlen = buf[buflen-1]; e r t o n o uint32_t i; D ! y l g U for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint32_t improper_index = -(i - (buflen - padlen) >> 31); uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); ok &= matches_pad | improper_index; b = improper_index & b; buf[i] = b; } return (ok & padlen) | ~ok; } 12μs 12μs 12μs 12μs 12μs 12μs 12μs 12μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  21. Padding removal: 4th try int32_t remove_padding4( uint8_t* buf, uint32_t buflen) { uint32_t ok = -1; ! d a uint8_t padlen = buf[buflen-1]; e r t o n o uint32_t i; D ! y l g U for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint32_t improper_index = -(i - (buflen - padlen) >> 31); ??? uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); ok &= matches_pad | improper_index; b = improper_index & b; buf[i] = b; } return (ok & padlen) | ~ok; } 12μs 12μs 12μs 12μs 12μs 12μs 12μs 12μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  22. Padding removal: 4th try int32_t remove_padding4( uint8_t* buf, uint32_t buflen) { uint32_t ok = -1; ! d a uint8_t padlen = buf[buflen-1]; e r t o n o uint32_t i; D ! y l g U for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint32_t improper_index = -(i - (buflen - padlen) >> 31); uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); ok &= matches_pad | improper_index; b = improper_index & b; buf[i] = b; } return (ok & padlen) | ~ok; } 12μs 12μs 12μs 12μs 12μs 12μs 12μs 12μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  23. Padding removal: 4th try int32_t remove_padding4( uint8_t* buf, uint32_t buflen) { uint32_t ok = -1; ! d a uint8_t padlen = buf[buflen-1]; e r t o n o uint32_t i; D ! y l g U for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint32_t improper_index = -(i - (buflen - padlen) >> 31); uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); random_sleep(); ok &= matches_pad | improper_index; b = improper_index & b; buf[i] = b; } return (ok & padlen) | ~ok; } 12μs 12μs 12μs 12μs 12μs 12μs 12μs 12μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  24. Padding removal: 4th try int32_t remove_padding4( uint8_t* buf, uint32_t buflen) { uint32_t ok = -1; ! d a uint8_t padlen = buf[buflen-1]; e r t o n o uint32_t i; D ! y l g U for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint32_t improper_index = -(i - (buflen - padlen) >> 31); uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); random_sleep(); ok &= matches_pad | improper_index; b = improper_index & b; buf[i] = b; } return (ok & padlen) | ~ok; } 12μs 12μs 12μs 12μs 12μs 12μs 12μs 12μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  25. Padding removal: 4th try int32_t remove_padding4( uint8_t* buf, uint32_t buflen) { uint32_t ok = -1; ! d a uint8_t padlen = buf[buflen-1]; e r t o n o uint32_t i; D ! y l g U for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint32_t improper_index = -(i - (buflen - padlen) >> 31); uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); sleep_til_max(); ok &= matches_pad | improper_index; b = improper_index & b; buf[i] = b; } return (ok & padlen) | ~ok; } 12μs 12μs 12μs 12μs 12μs 12μs 12μs 12μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  26. Padding removal: 4th try int32_t remove_padding4( uint8_t* buf, uint32_t buflen) { uint32_t ok = -1; ! d a uint8_t padlen = buf[buflen-1]; e r t o n o uint32_t i; D ! y l g U for (i = buflen-255; i < buflen; i++) { uint8_t b = buf[i]; uint32_t improper_index = -(i - (buflen - padlen) >> 31); uint32_t matches_pad = -((b ^ padlen) - 1 >> 31); sleep_til_max(); ok &= matches_pad | improper_index; b = improper_index & b; buf[i] = b; } return (ok & padlen) | ~ok; } 12μs 12μs 12μs 12μs 12μs 12μs 12μs 12μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  27. Writing constant-time code is hard ● Challenge : manually ensuring code is CT Manually keep track of secret vs. public ○ Standard programming constructs introduce timing leaks ○ Can’t simply pad/randomize ○ Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  28. Writing constant-time code is hard ● Challenge : manually ensuring code is CT Manually keep track of secret vs. public ○ Standard programming constructs introduce timing leaks ○ Can’t simply pad/randomize ○ ● Consequence : vulnerabilities! Difficult to write correct code ○ Hard to understand what CT code is doing ○ Hard to maintain CT code ○ Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  29. Error-prone in practice OpenSSL padding oracle attack Canvel, et al. “Password Interception in a SSL/TLS Channel.” Crypto, Vol. 2729. 2003. Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  30. Error-prone in practice Lucky 13 timing attack Al Fardan and Paterson. “Lucky thirteen: Breaking the TLS and DTLS record protocols.” Oakland 2013. Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  31. Error-prone in practice Further refinements Decryption path has no more measurable timing differences Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  32. Error-prone in practice Further refinements Decryption path has no more measurable timing differences Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  33. Error-prone in practice CVE-2016-2107 Somorovsky. “Curious padding oracle in OpenSSL.” Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  34. This is what DSLs are for! ● Explicitly distinguish secret vs. public values ● Type system to prevent writing leaky code ● Compiler to transform high-level constructs to CT Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  35. FaCT .c cc -c ld Final binary .o .h Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  36. FaCT .fact .c cc -c ld Final binary .o .h Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  37. FaCT FaCT .fact .c cc -c ld Final binary .o .h Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  38. FaCT FaCT .fact .h .o .c cc -c ld Final binary .o .h Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  39. FaCT FaCT .fact .h .o .c .c cc -c ld Final binary .o .h .h Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  40. What does FaCT look like? secret int32 remove_padding(secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { if (buf[i] != padlen) { return -1; } buf[i] = 0; } } return int32(padlen); } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  41. What does FaCT look like? secret int32 remove_padding( secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { if (buf[i] != padlen) { return -1; } buf[i] = 0; } } return int32(padlen); } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  42. What does FaCT look like? secret int32 remove_padding(secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { if (buf[i] != padlen) { return -1; } buf[i] = 0; } } return int32(padlen); } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  43. What does FaCT look like? secret int32 remove_padding(secret mut uint8[] buf) { assume (len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { if (buf[i] != padlen) { return -1; } buf[i] = 0; } } return int32(padlen); } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  44. What does FaCT look like? secret int32 remove_padding(secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { if (buf[i] != padlen) { return -1; } buf[i] = 0; } } return int32(padlen); } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  45. What does FaCT look like? secret int32 remove_padding(secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { if (buf[i] != padlen) { return -1; } buf[i] = 0; } } return int32(padlen); } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  46. What does FaCT look like? secret int32 remove_padding(secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { uint8_t b = buf[i]; if (buf[i] != padlen) { uint32_t improper_index = return -1; -(i - (buflen - padlen) >> 31); } uint32_t matches_pad = buf[i] = 0; -((b ^ padlen) - 1 >> 31); } ok &= matches_pad | improper_index; } b = improper_index & b; return int32(padlen); buf[i] = b; } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  47. What does FaCT look like? secret int32 remove_padding(secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { uint8_t b = buf[i]; if (buf[i] != padlen) { uint32_t improper_index = return -1; -(i - (buflen - padlen) >> 31); } uint32_t matches_pad = buf[i] = 0; -((b ^ padlen) - 1 >> 31); } ok &= matches_pad | improper_index; } b = improper_index & b; return int32(padlen); buf[i] = b; } 11μs 11μs 11μs 11μs 11μs 11μs 11μs 11μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  48. What does FaCT look like? secret int32 remove_padding( secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { if (buf[i] != padlen) { return -1; } buf[i] = 0; } } return int32(padlen); } 11μs 11μs 11μs 11μs 11μs 11μs 11μs 11μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  49. What does FaCT look like? secret int32 remove_padding(secret mut uint8[] buf) { assume(len buf >= 255); secret uint8 padlen = buf[len buf - 1]; for (uint64 i from len buf - 255 to len buf) { if (i >= len buf - padlen) { if (buf[i] != padlen) { return -1; } buf[i] = 0; } } return int32(padlen); } 11μs 11μs 11μs 11μs 11μs 11μs 11μs 11μs 53 74 ... 4c 6f 6f 70 31 38 00 00 00 Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  50. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  51. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Loop bounds ○ for (uint32 i from 0 to secret_value ) { do_operation(); } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  52. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Loop bounds ○ for (uint32 i from 0 to public_value ) { if (i < secret_value ) { do_operation(); } } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  53. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Loop bounds ○ Array indices ○ Cache lines x = sensitive_buffer[ secret_value ]; Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  54. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Loop bounds ○ Array indices ○ Cache lines for (uint32 i from public_lo to public_hi ) { if (i == secret_value ) { x = sensitive_buffer[ i ]; } } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  55. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Loop bounds ○ Array indices ○ Variable-time instructions ○ x = public_value / secret_value2 ; Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  56. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Loop bounds ○ Array indices ○ Variable-time instructions ○ x = public_value / public_value2 ; OR x = ct_div( public_value, secret_value2 ) ; Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  57. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Loop bounds ○ Array indices ○ Variable-time instructions ○ Recursive calls ○ secret uint32 fact(secret uint32 n) { if (n > 1) { return n * fact(n - 1); } return 1; } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  58. Labels ensure no leakage ● No assignment from secret to public ● Type system tracks control flow label Only transform secret control flow ○ ● Prevent secret expressions that leak: Loop bounds ○ Array indices ○ Variable-time instructions ○ Recursive calls ○ secret uint32 fact(secret uint32 n) { if (n > 1) { return n * fact(n - 1); } return 1; } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  59. Automatically transform code Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  60. Automatically transform code FaCT Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  61. Automatically transform code ● Transform secret branches ● Keep track of static control flow if (s) { if (s2) { x = 42; } else { x = 17; } y = x + 2; } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  62. Automatically transform code ● Transform secret branches ● Keep track of static control flow if (s) { if (s2) { x = 42; x = ct_select(s & s2, 42, x); } else { x = ct_select(s & ~s2, 17, x); x = 17; y = ct_select(s, x + 2, y); } y = x + 2; } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  63. Automatically transform code ● Transform away early returns ● Keep track of current return state if (s) { return 42; } return 17; Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  64. Automatically transform code ● Transform away early returns ● Keep track of current return state rval = ct_select(s & ~returned, 42, rval); if (s) { returned |= s; return 42; } rval = ct_select(~returned, 17, rval); return 17; returned |= true; ... return rval; Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  65. Automatically transform code ● Transform function side effects Depends on control flow state of caller ○ ● Pass the current control flow as an extra parameter if (s) { foo(ref x); } void foo(mut x) { x = 42; } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  66. Automatically transform code ● Transform function side effects Depends on control flow state of caller ○ ● Pass the current control flow as an extra parameter if (s) { foo(ref x); foo(ref x, s); } void foo(mut x) { void foo(mut x, bool state) { x = 42; x = ct_select(state, 42, x); } } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  67. Transformations are tricky if (i < secret_index) { buf[i] = 0; } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  68. Transformations are tricky if (i < secret_index) { m = (i < secret_index); buf[i] = 0; buf[i] = ct_select(m, 0, buf[i]); } Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  69. Transformations are tricky if (i < secret_index) { m = (i < secret_index); buf[i] = 0; buf[i] = ct_select(m, 0, buf[i] ); } ● Problem: secret if-statements always perform branches Does not guard execution ○ Similar problem for secret early return ○ Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

  70. Transformations are tricky if (i < secret_index) { m = (i < secret_index); buf[i] = 0; buf[i] = ct_select(m, 0, buf[i]); } ● Problem: secret if-statements always perform branches Does not guard execution ○ Similar problem for secret early return ○ ● Solution: disallow these programs! FaCT Z3 .fact Constant-time programming with FaCT Strange Loop 2018 Sunjay Cauligi

Recommend

Constant-time programming in FaCT What is FaCT? Domain specific language for writing

Constant-time programming in FaCT What is FaCT? Domain specific language for writing

Constant-time programming in FaCT What is FaCT? Domain specific language for writing constant-time code Whats the difference between a DSL and a general- purpose language? How do you use FaCT? Write your program in C Write your

420 views • 38 slides
FaCT A Flexible, Constant-Time Sunjay Cauligi , Gary Soeller, Programming Language Fraser Brown,

FaCT A Flexible, Constant-Time Sunjay Cauligi , Gary Soeller, Programming Language Fraser Brown,

FaCT A Flexible, Constant-Time Sunjay Cauligi , Gary Soeller, Programming Language Fraser Brown, Brian Johannesmeyer, Yunlu Huang, Ranjit Jhala, Deian Stefan Timing side channels Secret key Crypto Plaintext Encrypted FaCT SecDev 2017

652 views • 40 slides
+ - Can be constant or time varying +/- indicates polarity Current Source Can be

+ - Can be constant or time varying +/- indicates polarity Current Source Can be

Review of Circuit Analysis Common Symbols Independent Sources Battery Constant voltage DC voltage source Voltage Source + - Can be constant or time varying +/- indicates polarity Current Source Can be constant or time

388 views • 14 slides
1 of 30 Once Upon a Time... Constant diffusion: J = - D u u

1 of 30 Once Upon a Time... Constant diffusion: J = - D u u

1 of 30 Once Upon a Time... Constant diffusion: J = - D u u t = - J = D D u But is this truly realistic??? 2 of 30 Problems With Constant Diffusion Any initial

458 views • 32 slides
Real Time &amp; Embedded Systems C Language Programming Selected Topics Agenda A brief

Real Time &amp; Embedded Systems C Language Programming Selected Topics Agenda A brief

Real Time &amp; Embedded Systems C Language Programming Selected Topics Agenda A brief history of C Logical and Bit operations Shifting and Inversion Arrays and Pointers C Structures (struct) Constant qualifier (const)

765 views • 38 slides
Generating k -independent variables in constant time Tobias Christiani, Rasmus Pagh IT

Generating k -independent variables in constant time Tobias Christiani, Rasmus Pagh IT

Generating k -independent variables in constant time Tobias Christiani, Rasmus Pagh IT University of Copenhagen Generating k -independent variables in constant time 1 Introduction Random seed 11010100 01101101 Generator Pseudorandom output

1k views • 85 slides
CSE 341 : Programming Languages Lets fix the fact that our only example datatype so far was

CSE 341 : Programming Languages Lets fix the fact that our only example datatype so far was

Useful examples CSE 341 : Programming Languages Lets fix the fact that our only example datatype so far was silly Lecture 5 Enumerations, including carrying other data More Datatypes and Pattern Matching datatype suit = Club |

258 views • 6 slides
Demystifying Monads Amanda Laucher ThoughtWorks Scientific Fact Functional programming is the

Demystifying Monads Amanda Laucher ThoughtWorks Scientific Fact Functional programming is the

Demystifying Monads Amanda Laucher ThoughtWorks Scientific Fact Functional programming is the best way to model every computer programming solution Shared Language Monads/Gonads, WTH? Dave Thomas speakerconf 2010 Monad Tutorial Fallacy

593 views • 43 slides
Review Last Time: Programming Language History 50s, 60s: Exciting Time Invention

Review Last Time: Programming Language History 50s, 60s: Exciting Time Invention

Review Last Time: Programming Language History 50s, 60s: Exciting Time Invention of: assemblers, compilers, interpreters, first high- CSCI: 4500/6500 Programming level languages, structured programming , abstraction, formal syntax,

267 views • 7 slides
Review Last Time: Programming Language History 50s, 60s: Exciting Time Invention of:

Review Last Time: Programming Language History 50s, 60s: Exciting Time Invention of:

Review Last Time: Programming Language History 50s, 60s: Exciting Time Invention of: assemblers, compilers, interpreters, first high- CSCI: 4500/6500 Programming level languages, structured programming , abstraction, formal syntax,

202 views • 7 slides
Constant-time This code uses 256 squarings, square-and-multiply plus 1 extra multiplication for

Constant-time This code uses 256 squarings, square-and-multiply plus 1 extra multiplication for

1 2 Constant-time This code uses 256 squarings, square-and-multiply plus 1 extra multiplication for each bit set in e . D. J. Bernstein Problem when e is secret: time University of Illinois at Chicago; leaks number of bits set in e . Ruhr

381 views • 36 slides
Real- Real -time systems time systems Real- Real -time programming time programming

Real- Real -time systems time systems Real- Real -time programming time programming

EDA222/DIT160 Real-Time Systems, Chalmers/GU, 2008/2009 Lecture #2 Updated 2009-01-18 Real- Real -time systems time systems Real- Real -time programming time programming Recommended programming method: Recommended programming method:

251 views • 8 slides
Graph Transformation in Constant Time Mike Dodds miked@cs.york.ac.uk University of York Graph

Graph Transformation in Constant Time Mike Dodds miked@cs.york.ac.uk University of York Graph

Graph Transformation in Constant Time Mike Dodds miked@cs.york.ac.uk University of York Graph Transformation in Constant Time p.1/16 Sales Pitch Graph transformation is hard : polynomial or NP-complete depending on your point of view.

296 views • 28 slides
Understanding Genesis 1:13 Time is in fact the hero of the plot given so much time,

Understanding Genesis 1:13 Time is in fact the hero of the plot given so much time,

Understanding Genesis 1:13 Time is in fact the hero of the plot given so much time, the impossible becomes possible, and the possible probable, and the probable virtually certain. One has only to wait: time itself performs

1.28k views • 81 slides
Optimal Constant-Time Approximation Algorithms and (Unconditional) Inapproximability Results for

Optimal Constant-Time Approximation Algorithms and (Unconditional) Inapproximability Results for

Optimal Constant-Time Approximation Algorithms and (Unconditional) Inapproximability Results for Every Bounded-Degree CSP Yuichi Yoshida Kyoto Univ. &amp; Preferred Infrastructure 2011 5 26 Polynomial-Time Approximation

633 views • 37 slides
What solves this equation? Equation: n : if n = 0 then 1 else n 1 ) ? fact fact ( n

What solves this equation? Equation: n : if n = 0 then 1 else n 1 ) ? fact fact ( n

What solves this equation? Equation: n : if n = 0 then 1 else n 1 ) ? fact fact ( n = The factorial function! Factorial in lambda calculus Wish for: fact = \n.(zero? n) 1 (times n (fact (pred n))); But: on right-hand side, fact is

471 views • 14 slides
Real Real- -Time Systems Time Systems Low- Low -level programming level programming Low-

Real Real- -Time Systems Time Systems Low- Low -level programming level programming Low-

EDA222/DIT160 Real-Time Systems, Chalmers/GU, 2008/2009 Lecture #6 Updated 2009-02-01 Real Real- -Time Systems Time Systems Low- Low -level programming level programming Low- Low -level programming in Ada 95 enables writing level

223 views • 7 slides
Space-time models with dust and cosmological constant, that allow integrating the

Space-time models with dust and cosmological constant, that allow integrating the

Space-time models with dust and cosmological constant, that allow integrating the Hamilton-Jacobi test particle equation by separation of variables method. Konstantin E. Osetrin Tomsk State Pedagogical University Space-times models with dust

388 views • 27 slides
Time-delay cosmography: Tensions between the Hubble constant inferred from the early and late

Time-delay cosmography: Tensions between the Hubble constant inferred from the early and late

Time-delay cosmography: Tensions between the Hubble constant inferred from the early and late Universe Lon Koopmans (Kapteyn Astronomical Institute) Based on work by the H0LICOW, COSMOGRAIL, STRIDES and SHARP collaborations 1 Many slides

1.11k views • 85 slides
One&amp;Done: A Single-Decryption EM-Based Attack on OpenSSLs Constant-Time Blinded RSA Monjur

One&amp;Done: A Single-Decryption EM-Based Attack on OpenSSLs Constant-Time Blinded RSA Monjur

One&amp;Done: A Single-Decryption EM-Based Attack on OpenSSLs Constant-Time Blinded RSA Monjur Alam, Haider Adnan Khan, Moumita Dey, Nishith Sinha, Robert Callan, Alenka Zajic, and Milos Prvulovic 1 1 v Motivation Public key crypto is

363 views • 21 slides
Fast Constant-Time GCD Computation and Modular Inversion Daniel J. Bernstein 1,2 Bo-Yin Yang 3 1

Fast Constant-Time GCD Computation and Modular Inversion Daniel J. Bernstein 1,2 Bo-Yin Yang 3 1

Fast Constant-Time GCD Computation and Modular Inversion Daniel J. Bernstein 1,2 Bo-Yin Yang 3 1 University of Illinois at Chicago 2 Ruhr Universt at Bochum 3 Academia Sinica Monday, August 26, 2019 Summary: Fast, Safe GCD and Inversions

431 views • 23 slides
A measurement of the scintillation decay time constant in liquid xenon with the XMASS-I detector

A measurement of the scintillation decay time constant in liquid xenon with the XMASS-I detector

A measurement of the scintillation decay time constant in liquid xenon with the XMASS-I detector K. Ichimura Kamioka observatory, ICRR, the University of Tokyo Kavli IPMU for the XMASS collaboration TAUP2019, Toyama Japan 1 Motivation :

466 views • 22 slides
Fixslicing: A New GIFT Representation Fast Constant-Time Implementations of GIFT and GIFT-COFB on

Fixslicing: A New GIFT Representation Fast Constant-Time Implementations of GIFT and GIFT-COFB on

Fixslicing: A New GIFT Representation Fast Constant-Time Implementations of GIFT and GIFT-COFB on ARM Cortex-M Alexandre Adomnicai 1,2 Zakaria Najm 1,2,3 Thomas Peyrin 1,2 1 Nanyang Technological University, Singapore 2 Temasek Laboratories,

457 views • 34 slides
Bell Time Committee Report Charge : Fact finding, research based, viable bell time options worthy

Bell Time Committee Report Charge : Fact finding, research based, viable bell time options worthy

Bell Time Committee Report Charge : Fact finding, research based, viable bell time options worthy of additional consideration ( within the limitations imposed by NYS tax cap ) Reason for the Committee Growing concern on school start time based on

394 views • 16 slides

More recommend