Execution Secure Processors Eurocrypt May 1 st , 2017 Rafael Pass, - PowerPoint PPT Presentation

Formal Abstractions for Attested Execution Secure Processors Eurocrypt May 1 st , 2017 Rafael Pass, Elaine Shi, Florian Tramèr

Trusted hardware: Different communities, different world views 2

Trusted hardware: Different communities, different world views Systems Crypto Architecture & Security 2

Trusted hardware: Different communities, different world views Systems Crypto Architecture & Security • “ Minimal ” trusted hardware to circumvent theoretical impossibilities • Little concern about practical performance 2

Trusted hardware: Different communities, different world views Systems Crypto Architecture & Security • • “ Minimal ” trusted Trusted execution of hardware to circumvent “ general-purpose ” user- theoretical impossibilities defined progs • • Little concern about Cost-effectiveness, practical performance reusability, expressivity 2

Architecture community converged on “attested execution” GhostRider Bastion TPM Iso-X Ascend Sanctum Aegis Phantom XOM Academia Industry 3

Architecture community converged on “attested execution” 4

Attested Execution Server Compute prog on inp Client 5

Attested Execution Server Enclave Compute prog on inp Client 5

Attested Execution Server Enclave Compute prog on inp Client Sign Verify Manufacturer 5

Attested Execution Server Enclave Compute prog on inp Client outp, σ Sign Verify Attestation that outp is correctly computed from prog and inp Manufacturer 5

Why Ideal Abstractions? 6

Why Ideal Abstractions? • Formal security proofs for implementations from precise abstractions and security models 6

Why Ideal Abstractions? • Formal security proofs for implementations from precise abstractions and security models • Ultimate Goal: Formally verified processor implementing this formal abstraction 6

Formal Model Signature scheme Registry of all platforms with trusted hardware 𝓗 att [ Σ , reg] 7

Formal Model Signature scheme Registry of all platforms with trusted hardware 𝓗 att [ Σ , reg] ⟵ Σ .KeyGen(1 λ ) init (): , getpk () from P: send to P 7

Formal Model Signature scheme Registry of all platforms with trusted hardware 𝓗 att [ Σ , reg] ⟵ Σ .KeyGen(1 λ ) init (): , getpk () from P: send to P install (prog, sid) from P ∊ reg: 7

Formal Model Signature scheme Registry of all platforms with trusted hardware 𝓗 att [ Σ , reg] ⟵ Σ .KeyGen(1 λ ) init (): , enclave id enclave getpk () from P: send to P (nonce) memory install (prog, sid) from P ∊ reg: (eid, P) ( sid, prog, M ) … … 7

Formal Model Signature scheme Registry of all platforms with trusted hardware 𝓗 att [ Σ , reg] ⟵ Σ .KeyGen(1 λ ) init (): , enclave id enclave getpk () from P: send to P (nonce) memory install (prog, sid) from P ∊ reg: (eid, P) ( sid, prog, M ) … … resume (eid, inp) from P ∊ reg: 7

Formal Model Signature scheme Registry of all platforms with trusted hardware 𝓗 att [ Σ , reg] ⟵ Σ .KeyGen(1 λ ) init (): , enclave id enclave getpk () from P: send to P (nonce) memory install (prog, sid) from P ∊ reg: (eid, P) ( sid, prog, M ) … … resume (eid, inp) from P ∊ reg: (out, M’ ) = prog(inp, M) 7

Formal Model Signature scheme Registry of all platforms with trusted hardware 𝓗 att [ Σ , reg] ⟵ Σ .KeyGen(1 λ ) init (): , enclave id enclave getpk () from P: send to P (nonce) memory install (prog, sid) from P ∊ reg: (eid, P) ( sid, prog, M ) ’ … … resume (eid, inp) from P ∊ reg: (out, M’ ) = prog(inp, M) 7

Formal Model Signature scheme Registry of all platforms with trusted hardware 𝓗 att [ Σ , reg] ⟵ Σ .KeyGen(1 λ ) init (): , enclave id enclave getpk () from P: send to P (nonce) memory install (prog, sid) from P ∊ reg: (eid, P) ( sid, prog, M ) ’ … … resume (eid, inp) from P ∊ reg: (out, M’ ) = prog(inp, M) σ = Σ .Sign( , eid, sid, prog, out) send (out, σ ) to P 7

Composability with Global State 8

Composability with Global State Model 𝓗 att as global ideal functionality [CDPW’07] 8

Composability with Global State Model 𝓗 att as global ideal functionality [CDPW’07] Attestation key is shared across protocols 𝓗 att [ Σ , reg] 8

Composability with Global State Model 𝓗 att as global ideal functionality [CDPW’07] 𝓗 att [ Σ , reg] σ 9

Composability with Global State Model 𝓗 att as global ideal functionality [CDPW’07] Example of concrete security issue: Non-deniability for parties in reg 𝓗 att [ Σ , reg] σ 9

The more interesting question 10

The good Powerful Abstraction! 11

The good Powerful Abstraction! 𝓗 att ➔ ‘’Stateful Obfuscation’’ Impossible even with stateless tokens and cryptographic obfuscation 11

The good The surprise Powerful UC-Secure MPC? Abstraction! 𝓗 att ➔ ‘’Stateful Obfuscation’’ Impossible even with stateless tokens and cryptographic obfuscation 11

The good The surprise Powerful UC-Secure MPC? Abstraction! 𝓗 att ➔ ‘’Stateful Obfuscation’’ Impossible even with stateless tokens and cryptographic obfuscation 11

The surprise UC-Secure MPC? 12

Consider 2PC 13

Consider 2PC UC-secure 2PC possible if both parties have trusted hardware 14

Consider 2PC UC-secure 2PC possible if both parties have trusted hardware Impossible if only one party has trusted hardware! 14

Consider 2PC This is counter-intuitive. Impossible if only one party has trusted hardware! 15

Issue: non-deniability under global pk 16

Issue: non-deniability Convinced that some honest party in the registry participated in the protocol under global pk 16

Non-issue if all nodes have trusted hardware or if pk isn’t global Convinced that some honest party in the registry participated in the protocol under global pk 17

What if we really really want to use a single trusted processor? 18

What if we really really want to use a single trusted processor? Extra setup assumption: Augmented CRS 18

What if we really really want to use a single trusted processor? Extra setup assumption: Augmented CRS UC-Secure MPC with O(1) crypto operations 18

What if we really really want to use a single trusted processor? Extra setup assumption: Augmented CRS UC-Secure MPC with O(1) crypto operations Backdoor enclave program: allow simulator to extract inputs and program the outputs for corrupt parties 18

What if we really really want to use a single trusted processor? Server prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] 𝒬 i 19

What if we really really want to use a single trusted processor? Server prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] 1. Generate pk i ,sk i 𝒬 i 19

What if we really really want to use a single trusted processor? Server Full protocol replaces σ by a WI-Proof prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] pk i , σ 1. Generate pk i ,sk i 𝒬 i 19

What if we really really want to use a single trusted processor? Server Full protocol replaces σ by a WI-Proof prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] pk i , σ 1. Generate pk i ,sk i Key-exchange 𝒬 i 19

What if we really really want to use a single trusted processor? Server Full protocol replaces σ by a WI-Proof prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] pk i , σ 1. Generate pk i ,sk i Key-exchange 𝒬 i 1. Collect all inp i Encrypted inp i 19

What if we really really want to use a single trusted processor? Server Full protocol replaces σ by a WI-Proof prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] pk i , σ 1. Generate pk i ,sk i Key-exchange 𝒬 i 1. Collect all inp i Encrypted inp i 2. Compute outp * Encrypted outp i 19

What if we really really want to use a single trusted processor? Server prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] 3. Trapdoors Sim 20

What if we really really want to use a single trusted processor? Server prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] 3. Trapdoors extract(id i ) check( 𝒣 acrs , 𝒬 i , id i ) Sim 20

What if we really really want to use a single trusted processor? Server prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] Sim can recover inp i 3. Trapdoors extract(id i ) check( 𝒣 acrs , 𝒬 i , id i ) sk i Sim 20

What if we really really want to use a single trusted processor? Server prog[f, 𝓗 acrs , 𝒬 1 … 𝒬 n ] 3. Trapdoors Sim equivocate(id i , v) check( 𝒣 acrs , 𝒬 i , id i ) set outp i = v 20

Fair 2PC? 21

• Fairness impossible for general functionalities in plain model [Cleve86] Fair 2PC? 21

Can trusted hardware help with fairness? • Fairness impossible for general functionalities in plain model [Cleve86] Fair 2PC? 21

UC-Secure Fair 2PC Enhanced model: Clock-aware secure processor 22

UC-Secure Fair 2PC Enhanced model: Clock-aware secure processor • Fair 2PC possible if both parties have clock- aware secure processors 22