fact a dsl for timing sensitive computation
play

FaCT: A DSL for Timing-Sensitive Computation Sunjay Cauligi , UC San - PowerPoint PPT Presentation

FaCT: A DSL for Timing-Sensitive Computation Sunjay Cauligi , UC San Diego Gary Soeller, Brian Johannesmeyer, Fraser Brown, Riad Wahby, John Renner, Benjamin Gregoire, Gilles Barthe, Ranjit Jhala, Deian Stefan What does this code do? for (i =


  1. Transform everything? Slower but necessary if (secret) { x = -secret & 19 | (secret-1) & x; x = 19; } if (public) { y = -public & 42 | (public-1) & y; y = 42; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  2. Transform everything? Slower but necessary if (secret) { x = -secret & 19 | (secret-1) & x; x = 19; } Slower and unnecessary ! if (public) { y = -public & 42 | (public-1) & y; y = 42; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  3. Transform everything? Slower but necessary if (secret) { x = -secret & 19 | (secret-1) & x; x = 19; } Slower and unnecessary ! if (public) { y = -public & 42 | (public-1) & y; y = 42; } Only transform if code leaks secret values FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  4. Explicit secrecy in the type system secret uint32 decrypt( secret uint32 key, public uint32 msg) { if (key > 40) { ... } ... } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  5. Explicit secrecy in the type system secret uint32 decrypt( secret uint32 key, public uint32 msg) { if (key > 40) { ... } ... } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  6. Explicit secrecy in the type system secret uint32 decrypt( secret uint32 key, public uint32 msg) { if (key > 40) { ... } We can detect secret leakage! ... } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  7. Type system detects leaks via... ● Conditional branches ● Early termination ● Function side effects ● Memory access patterns ● Direct assignment ● … FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  8. Type system detects leaks via... ● Conditional branches ● Early termination FaCT transforms these ● Function side effects ● Memory access patterns ● Direct assignment ● … FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  9. Type system detects leaks via... ● Conditional branches ● Early termination FaCT transforms these ● Function side effects ● Memory access patterns FaCT disallows these ● Direct assignment ● … FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  10. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  11. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  12. Transforming control flow ● Conditional branches ● Early termination ● Function side effects FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  13. Transforming control flow ● Conditional branches ● Early termination ● Function side effects FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  14. Transform secret conditionals if (s) { x = 40; } else { x = 19; y = x + 2; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  15. Transform secret conditionals if (s) { x = 40; x = -s & 40 | (s-1) & x; } else { x = 19; y = x + 2; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  16. Transform secret conditionals if (s) { x = 40; x = -s & 40 | (s-1) & x; } else { x = 19; y = x + 2; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  17. Transform secret conditionals if (s) { x = 40; x = -s & 40 | (s-1) & x; } else { x = (s-1) & 19 | -s & x; x = 19; y = x + 2; y = (s-1) & (x + 2) | -s & y; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  18. Transform secret conditionals if (s) { x = 40; x = -s & 40 | (s-1) & x; } else { x = (s-1) & 19 | -s & x; x = 19; y = x + 2; y = (s-1) & (x + 2) | -s & y; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  19. Secret returns are conditionals too if (s) { return 40; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  20. Secret returns are conditionals too if (s) { if (!done) { if (s) { rval = 40; return 40; done = true; } } } ... return rval; FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  21. Secret returns are conditionals too if (s) { if (!done) { if (s) { rval = 40; return 40; done = true; } } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  22. Secret returns are conditionals too if (s) { if (!done) { if (s) { rval = 40; return 40; done = true; } } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  23. Secret returns are conditionals too if (s) { if (!done) { if (s) { rval = 40; rval = (-s & (done-1)) & 40 | ... return 40; done = (-s & (done-1)) & true | ... done = true; } } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  24. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  25. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  26. Not all transformations are good ● May produce inefficient code ● May produce unsafe code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  27. Not all transformations are good ● May produce inefficient code ● May produce unsafe code Type system rejects such programs FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  28. Inefficient transformations x = buffer[ secret_index ]; FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  29. Inefficient transformations for (uint32 i from 0 to len buffer) { if (i == secret_index) { x = buffer[ secret_index ]; x = buffer[i]; } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  30. Inefficient transformations O(1) O(n) for (uint32 i from 0 to len buffer) { if (i == secret_index) { x = buffer[ secret_index ]; x = buffer[i]; } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  31. Inefficient transformations O(1) O(n) for (uint32 i from 0 to len buffer) { if (i == secret_index) { x = buffer[ secret_index ]; x = buffer[i]; } } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  32. Inefficient transformations O(1) O(n) for (uint32 i from 0 to len buffer) { if (i == secret_index) { x = buffer[ secret_index ]; x = buffer[i]; } } Reject if transformation is inefficient FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  33. Unsafe transformations if (j < secret_len) { x = arr[j]; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  34. Unsafe transformations x = -(j < secret_len) & arr[j] if (j < secret_len) { | ((j < secret_len)-1) & x; x = arr[j]; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  35. Unsafe transformations x = -(j < secret_len) & arr[j] if (j < secret_len) { | ((j < secret_len)-1) & x; x = arr[j]; } FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  36. Unsafe transformations x = -(j < secret_len) & arr[j] if (j < secret_len) { | ((j < secret_len)-1) & x; x = arr[j]; } What if j > len arr ? FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  37. Unsafe transformations x = -(j < secret_len) & arr[j] if (j < secret_len) { | ((j < secret_len)-1) & x; x = arr[j]; } What if j > len arr ? Out of bounds access! FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  38. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  39. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  40. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  41. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  42. Type system checks safety Check for out-of-bounds accesses Solve constraints using Z3 Path sensitive except secret branches Reject if transformation is unsafe FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  43. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  44. Transforming to constant-time ● What to transform? ● How to transform? ● What not to transform? ● Evaluation FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  45. Evaluating FaCT ● Can FaCT express real code? ● Is FaCT code as fast as C? ● Is FaCT more readable than C? FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  46. Evaluating FaCT ● Can FaCT express real code? ● Is FaCT code as fast as C? ● Is FaCT more readable than C? FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  47. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  48. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  49. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  50. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  51. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT obj .fact FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  52. Porting code to FaCT ● Rewrite the whole library ● Rewrite a function (and callees) ● Rewrite a chunk of code FaCT obj .fact clang linker Final binary .c obj FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  53. Porting code to FaCT ● Rewrite the whole library: donna curve25519 ● Rewrite a function (and callees): libsodium secretbox ● Rewrite a chunk of code: OpenSSL ssl3/TLS record verification FaCT obj .fact clang linker Final binary .c obj FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  54. Porting code to FaCT ● Rewrite the whole library: donna curve25519 ● Rewrite a function (and callees): libsodium secretbox ● Rewrite a chunk of code: OpenSSL ssl3/TLS record verification Lines of code donna secretbox ssl3 TLS FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  55. Real code needs escape hatches ● Declassify ○ ○ ● Assume ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  56. Real code needs escape hatches ● Declassify secrets to public ○ ○ ● Assume ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  57. Real code needs escape hatches ● Declassify secrets to public ○ secretbox: if (! declassify (crypto_verify(...)) return false; ○ ● Assume ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  58. Real code needs escape hatches ● Declassify secrets to public ○ secretbox: if (! declassify (crypto_verify(...)) return false; ○ TLS: b = pmac[ declassify (i)]; ● Assume ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  59. Real code needs escape hatches ● Declassify secrets to public ○ secretbox: if (! declassify (crypto_verify(...)) return false; ○ TLS: b = pmac[ declassify (i)]; ● Assume constraints for solver ○ ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

  60. Real code needs escape hatches ● Declassify secrets to public ○ secretbox: if (! declassify (crypto_verify(...)) return false; ○ TLS: b = pmac[ declassify (i)]; ● Assume constraints for solver ○ Function preconditions ○ ● Extern FaCT: A DSL for Timing-Sensitive Computation PLDI 2019 Sunjay Cauligi

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend