fact a dsl for timing sensitive computation
play

FaCT: A DSL for Timing-Sensitive Computation Sunjay Cauligi , UC San - PowerPoint PPT Presentation

FaCT: A DSL for Timing-Sensitive Computation Sunjay Cauligi , UC San Diego Gary Soeller, Brian Johannesmeyer, Fraser Brown, Riad Wahby, John Renner, Benjamin Gregoire, Gilles Barthe, Ranjit Jhala, Deian Stefan What does this code do? for (i =


  1. Transform everything? Slower but necessary if (secret) { x = -secret & 19 | (secret-1) & x; x = 19; } if (public) { y = -public & 42 | (public-1) & y; y = 42; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  2. Transform everything? Slower but necessary if (secret) { x = -secret & 19 | (secret-1) & x; x = 19; } Slower and unnecessary ! if (public) { y = -public & 42 | (public-1) & y; y = 42; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  3. Transform everything? Slower but necessary if (secret) { x = -secret & 19 | (secret-1) & x; x = 19; } Slower and unnecessary ! if (public) { y = -public & 42 | (public-1) & y; y = 42; } Only transform if code leaks secret values FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  4. Explicit secrecy in the type system secret uint32 decrypt( secret uint32 key, public uint32 msg) { if (key > 40) { ... } ... } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  5. Explicit secrecy in the type system secret uint32 decrypt( secret uint32 key, public uint32 msg) { if (key > 40) { ... } ... } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  6. Explicit secrecy in the type system secret uint32 decrypt( secret uint32 key, public uint32 msg) { if (key > 40) { ... } We can detect secret leakage! ... } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  7. Type system detects leaks via... ● Conditional branches ● Early termination ● Function side effects ● Memory access patterns ● Direct assignment ● … FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  8. Type system detects leaks via... ● Conditional branches ● Early termination FaCT transforms these ● Function side effects ● Memory access patterns ● Direct assignment ● … FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  9. Type system detects leaks via... ● Conditional branches ● Early termination FaCT transforms these ● Function side effects ● Memory access patterns FaCT disallows these ● Direct assignment ● … FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  10. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  11. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  12. Transforming control flow ● Conditional branches ● Early termination ● Function side effects FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  13. Transforming control flow ● Conditional branches ● Early termination ● Function side effects FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  14. Transform secret conditionals if (s) { x = 40; } else { x = 19; y = x + 2; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  15. Transform secret conditionals if (s) { x = 40; x = -s & 40 | (s-1) & x; } else { x = 19; y = x + 2; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  16. Transform secret conditionals if (s) { x = 40; x = -s & 40 | (s-1) & x; } else { x = 19; y = x + 2; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  17. Transform secret conditionals if (s) { x = 40; x = -s & 40 | (s-1) & x; } else { x = (s-1) & 19 | -s & x; x = 19; y = x + 2; y = (s-1) & (x + 2) | -s & y; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  18. Transform secret conditionals if (s) { x = 40; x = -s & 40 | (s-1) & x; } else { x = (s-1) & 19 | -s & x; x = 19; y = x + 2; y = (s-1) & (x + 2) | -s & y; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  19. Secret returns are conditionals too if (s) { return 40; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  20. Secret returns are conditionals too if (s) { if (!done) { if (s) { rval = 40; return 40; done = true; } } } ... return rval; FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  21. Secret returns are conditionals too if (s) { if (!done) { if (s) { rval = 40; return 40; done = true; } } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  22. Secret returns are conditionals too if (s) { if (!done) { if (s) { rval = 40; return 40; done = true; } } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  23. Secret returns are conditionals too if (s) { if (!done) { if (s) { rval = 40; rval = (-s & (done-1)) & 40 | ... return 40; done = (-s & (done-1)) & true | ... done = true; } } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  24. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  25. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  26. Not all transformations are good ● May produce inefficient code ● May produce unsafe code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  27. Not all transformations are good ● May produce inefficient code ● May produce unsafe code Type system rejects such programs FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  28. Inefficient transformations x = buffer[ secret_index ]; FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  29. Inefficient transformations for (uint32 i from 0 to len buffer) { if (i == secret_index) { x = buffer[ secret_index ]; x = buffer[i]; } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  30. Inefficient transformations O(1) O(n) for (uint32 i from 0 to len buffer) { if (i == secret_index) { x = buffer[ secret_index ]; x = buffer[i]; } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  31. Inefficient transformations O(1) O(n) for (uint32 i from 0 to len buffer) { if (i == secret_index) { x = buffer[ secret_index ]; x = buffer[i]; } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  32. Inefficient transformations O(1) O(n) for (uint32 i from 0 to len buffer) { if (i == secret_index) { x = buffer[ secret_index ]; x = buffer[i]; } } Reject if transformation is inefficient FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  33. Unsafe transformations if (j < secret_len) { x = arr[j]; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  34. Unsafe transformations x = -(j < secret_len) & arr[j] if (j < secret_len) { | ((j < secret_len)-1) & x; x = arr[j]; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  35. Unsafe transformations x = -(j < secret_len) & arr[j] if (j < secret_len) { | ((j < secret_len)-1) & x; x = arr[j]; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  36. Unsafe transformations x = -(j < secret_len) & arr[j] if (j < secret_len) { | ((j < secret_len)-1) & x; x = arr[j]; } What if j > len arr ? FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  37. Unsafe transformations x = -(j < secret_len) & arr[j] if (j < secret_len) { | ((j < secret_len)-1) & x; x = arr[j]; } What if j > len arr ? Out of bounds access! FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  38. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  39. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  40. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  41. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  42. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  43. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  44. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  45. Evaluating FaCT ● Can FaCT express real code? ● Is FaCT code as fast as C? ● Is FaCT more readable than C? FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  46. Evaluating FaCT ● Can FaCT express real code? ● Is FaCT code as fast as C? ● Is FaCT more readable than C? FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  47. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  48. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  49. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  50. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  51. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT obj .fact FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  52. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT obj .fact clang linker Final binary .c obj FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  53. Porting code to FaCT ● Rewrite the whole library: donna curve25519 ● Rewrite a function (and callees): libsodium secretbox ● Rewrite a chunk of code: OpenSSL ssl3/TLS record verification FaCT obj .fact clang linker Final binary .c obj FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  54. Porting code to FaCT ● Rewrite the whole library: donna curve25519 ● Rewrite a function (and callees): libsodium secretbox ● Rewrite a chunk of code: OpenSSL ssl3/TLS record verification Lines of code donna secretbox ssl3 TLS FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  55. Real code needs escape hatches ● Declassify ○ ○ ● Assume ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  56. Real code needs escape hatches ● Declassify secrets to public ○ ○ ● Assume ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  57. Real code needs escape hatches ● Declassify secrets to public ○ secretbox: if (! declassify (crypto_verify(...)) return false; ○ ● Assume ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  58. Real code needs escape hatches ● Declassify secrets to public ○ secretbox: if (! declassify (crypto_verify(...)) return false; ○ TLS: b = pmac[ declassify (i)]; ● Assume ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  59. Real code needs escape hatches ● Declassify secrets to public ○ secretbox: if (! declassify (crypto_verify(...)) return false; ○ TLS: b = pmac[ declassify (i)]; ● Assume constraints for solver ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  60. Real code needs escape hatches ● Declassify secrets to public ○ secretbox: if (! declassify (crypto_verify(...)) return false; ○ TLS: b = pmac[ declassify (i)]; ● Assume constraints for solver ○ Function preconditions ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

Recommend


More recommend