From Trust Anchors to Melt ltdown of f Trust Ahmad-Reza Sadeghi - PowerPoint PPT Presentation

Physical Attacks: : Example: [T [Taji jik et t al., l., CH CHES ’14 ] Upper path delay 𝑋 𝑣 Challenge 𝒅 𝟏 𝒅 𝟐 𝒅 𝟑 𝒅 𝟒 𝒅 𝟓 𝒅 𝟔 𝒅 𝟕 𝒅 𝟖 Response 0 Impulse 1 Switch Arbiter Lower path delay 𝑋 𝑚 C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝑿 𝒗 𝑿 𝒎

Physical Attacks: : Example: [T [Taji jik et t al., l., CH CHES ’14 ] Upper path delay 𝑋 𝑣 Challenge 0 0 0 0 0 0 0 0 Response 0 Impulse 1 Switch Arbiter Lower path delay 𝑋 𝑚 C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝒘 𝟐 𝑿 𝒗 𝒗 𝟐 𝑿 𝒎

Physical Attacks: : Example: [T [Taji jik et t al., l., CH CHES ’14 ] Upper path delay 𝑋 𝑣 Challenge 1 0 0 0 0 0 0 0 Response 0 Impulse 1 Switch Arbiter Lower path delay 𝑋 𝑚 C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝒘 𝟐 𝒘 𝟑 𝑿 𝒗 𝒗 𝟐 𝒗 𝟑 𝑿 𝒎

Physical Attacks: : Example: [T [Taji jik et t al., l., CH CHES ’14 ] Upper path delay 𝑋 𝑣 Challenge 𝒅 𝟏 𝒅 𝟐 𝒅 𝟑 𝒅 𝟒 𝒅 𝟓 𝒅 𝟔 𝒅 𝟕 𝒅 𝟖 Response 0 Impulse 1 Switch Arbiter Lower path delay 𝑋 𝑚 C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝒘 𝟐 𝒘 𝟑 𝑿 𝒗 𝒗 𝟐 𝒗 𝟑 𝑿 𝒎

Physical Attacks: : Example: [T [Taji jik et t al., l., CH CHES ’14 ] Characterize each switch box in the Arbiter PUF by calculating Upper path delay 𝑋 the delay differences for upper and lower paths 𝑣 Challenge 𝒅 𝟏 𝒅 𝟐 𝒅 𝟑 𝒅 𝟒 𝒅 𝟓 𝒅 𝟔 𝒅 𝟕 𝒅 𝟖 Response 0 Impulse 1 Switch Arbiter Lower path delay 𝑋 𝑚 C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝒘 𝟐 𝒘 𝟑 𝑿 𝒗 𝒗 𝟐 𝒗 𝟑 𝑿 𝒎

Physical Attacks: : Example: [T [Taji jik et t al., l., CH CHES ’14 ] Characterize each switch box in the Arbiter PUF by calculating Upper path delay 𝑋 the delay differences for upper and lower paths 𝑣 Challenge 𝒅 𝟏 𝒅 𝟐 𝒅 𝟑 𝒅 𝟒 𝒅 𝟓 𝒅 𝟔 𝒅 𝟕 𝒅 𝟖 Response 0 Impulse 1 Switch Arbiter Lower path delay 𝑋 𝑚 C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝒘 𝟐 𝒘 𝟑 𝑿 𝒗 𝒗 𝟐 𝒗 𝟑 𝑿 𝒎

Physical Attacks: : Example: [T [Taji jik et t al., l., CH CHES ’14 ] Characterize each switch box in the Arbiter PUF by calculating Upper path delay 𝑋 the delay differences for upper and lower paths 𝑣 Challenge 𝒅 𝟏 𝒅 𝟐 𝒅 𝟑 𝒅 𝟒 𝒅 𝟓 𝒅 𝟔 𝒅 𝟕 𝒅 𝟖 𝒗𝟏 − 𝒙 𝟏 𝒗𝟏 𝒘 𝟐 − 𝒘 𝟑 = 𝒙 𝟐 Response 0 Impulse 1 Switch Arbiter Lower path delay 𝑋 𝑚 C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝒘 𝟐 𝒘 𝟑 𝑿 𝒗 𝒗 𝟐 𝒗 𝟑 𝑿 𝒎

Physical Attacks: : Example: [T [Taji jik et t al., l., CH CHES ’14 ] Characterize each switch box in the Arbiter PUF by calculating Upper path delay 𝑋 the delay differences for upper and lower paths 𝑣 Challenge 𝒅 𝟏 𝒅 𝟐 𝒅 𝟑 𝒅 𝟒 𝒅 𝟓 𝒅 𝟔 𝒅 𝟕 𝒅 𝟖 𝒗𝟏 − 𝒙 𝟏 𝒗𝟏 𝒘 𝟐 − 𝒘 𝟑 = 𝒙 𝟐 Response 0 Impulse 1 𝑚0 − 𝑥 0 𝑚0 𝒗 𝟐 − 𝒗 𝟑 = 𝑥 1 Switch Arbiter Lower path delay 𝑋 𝑚 C 0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80 𝒘 𝟐 𝒘 𝟑 𝑿 𝒗 𝒗 𝟐 𝒗 𝟑 𝑿 𝒎

Beyond CMOS-based PUFs CMOS-based PUFs exhibit linear behavior => vulnerable to machine learning One Solution: Add components with non-linear behavior to complicate/escape machine learning attacks, e.g., Memristors

∞ Memris istors • A resistor that changes it resistance as voltage is applied • Applications: • Oscillators Current • Learners (Neural Networks) • Memories • PUFs! • The top (bottom) figure shows Current-Voltage charcteristics of a memristor (resistor) Voltage Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

CMOS-based APUF vs. . Memris istor-based APUF Challenge 𝒅 𝟏 𝒅 𝟐 𝒅 𝟑 𝒅 𝟒 𝒅 𝟓 𝒅 𝟔 𝒅 𝟕 𝒅 𝟖 Response 0 Impulse 1 Arbiter Challenge 𝒅 𝟏 𝒅 𝟐 𝒅 𝟑 𝒅 𝟒 𝒅 𝟓 𝒅 𝟔 𝒅 𝟕 𝒅 𝟖 ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ Response 0 Impulse ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ 1 Arbiter Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

CMOS-based APUF vs. . Memris istor-based APUF CMOS-based Arbiter PUF: Voltage at the upper path Memristor-based Arbiter PUF: Voltage at the upper path Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Conclu lusio ion • Many PUF designs, no unified security model • Several successful attacks • Non-destructive physical attacks • Modeling attacks • Designing secure PUFs is challenging? • What are the costs? • PUFs based on advanced memory technologies • E.g., Memristors

Our Current Work: Framework for Evaluation of f Memristor-based PUFs

Framework for Evaluation of f Memristor-based PUFs Memristor model Advanced Machine Spice PUF Secure/Insecure Challenge- Learning PUF Description circuit CRPs PUF PUF Circuit Response Generation Pairs Generation Analysis of PUF properties: Reproducibility, uniqueness, etc

In Integrated Securit ity Devic ices: The TPM Promise Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Tru rusted Computing • Authenticated Boot and Attestation App 1 App 2 App 3 App 4 Software Stack Operating System Hardware Peripherals CPU Memory I/O TPM Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Tru rusted Computing • Authenticated Boot and Attestation App 1 App 1 App 2 App 2 App 3 App 3 App 4 App 4 Software Stack Operating System Operating System Hardware Peripherals CPU Memory I/O TPM Example: IBM Integrity Measurement Architecture (IMA) Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Tru rusted Computing • Authenticated Boot and Attestation App 1 App 2 App 3 App 4 Software Stack Operating System Runtime attacks (e.g., Code-reuse Attacks) Hardware Peripherals CPU Memory I/O TPM Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Summary ry: : TPM-based Tru rusted Computing TPM assumptions and shortcomings • Binary hashes express trustworthiness of code • Runtime attacks (e.g., code reuse) undermine this assumption • Unforgeability of measurements • TPM 1.2 uses deprecated SHA1 • Protection against software attacks only • Hardware attacks on TPM Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Current Work: Control-Flow Attestation Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Ongoing Work rk: : Towards Run-time Attestation • Control Flow Attestation [Davi et al, CCS 2016 & DAC 2017] Prover Verifier Challenge Memory App A Online: Offline: Control-Flow Graph (CFG) Runtime Analysis & Path Measurement Validation Processor LP 1 Attestation Engine P* x P* 2 Controller Hash Measurement Database P 1 P 2 Resilient to memory attacks Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Trusted Executio ion Envir ironment (TEE) Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

ARM Tru rustZone Assumptions: • Apps in Secure World are trustworthy • Normal World cannot influence Secure World App 1 App 2 App 3 App 4 Software Stack Operating System Hardware Peripherals CPU Memory I/O IMEI: International Mobile Equipment Identifier Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

• Subsidy Lock Android ARM Tru rustZone • • IMEI Protection Full-Disk Encryption (FDE) • Samsung KNOX Assumptions: iOS • Secure-I/O, Attestation • Device Encryption • • Apps in Secure World are trustworthy Real-time Kernel • Touch ID, Apple Pay Protection (TIMA) • Normal World cannot influence Secure World Secure World DRM • Netflix • App 1 App 2 App 3 Trustlet Trustlet Trustlet Spotify • Widevine 1 2 3 Software Stack Operating System Operating System Hardware Peripherals CPU Memory I/O IMEI: International Mobile Equipment Identifier Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

ARM Tru rustZone Assumptions: • Apps in Secure World are trustworthy • Normal World cannot influence Secure World Secure World App 1 App 2 App 3 Trustlet Trustlet Trustlet 1 2 3 Software Stack Operating System Operating System Hardware Peripherals CPU Memory I/O IMEI: International Mobile Equipment Identifier Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

ARM Tru rustZone Assumptions: • Apps in Secure World are trustworthy • Normal World cannot influence Secure World Secure World App 1 App 2 App 3 Trustlet Trustlet Trustlet Trustlet Trustlet Trustlet 1 1 2 2 3 3 Software Stack • Reflections on trusting TrustZone Operating System Operating System Operating System [Dan Rosenberg, BlackHat US, 2014] • Attacking your Trusted Core [Di Shen, BlackHat US, 2015] • Hardware Peripherals CPU Memory I/O Breaking Android Full Disc Encryption [laginimaineb from Project Zero, 2016] IMEI: International Mobile Equipment Identifier Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Summary ry: : ARM Tru rustZone • ARM TrustZone – Outdated? • Deployed for almost two decades • Trusted computing for vendors and friends only • No access for app developer • Many attacks have been shown over the last years • On the positive side • Secure I/O Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Current Work: “Arbitrary” Number of TEEs in Normal World on ARM TZ Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Intel Software Guard Extensions (SGX) App 1 App 2 App 3 App 4 Enclave 1 Enclave 2 Enclave 3 Enclave 4 Software Stack Operating System Hardware Peripherals CPU Memory I/O Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Intel Software Guard Extensions (SGX) App 1 App 2 App 3 App 4 Enclave 1 Enclave 2 Enclave 3 Enclave 4 Software Stack Operating System Hardware Peripherals CPU Memory I/O Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

SGX (A (Adversary ry) Model Host Enclave Application N Application Attacker Operating System NIC CPU MMU DRAM Isolation NIC: Network Interface Controller Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 MMU: Memory Management Unit

SGX (A (Adversary ry) Model Host Host Enclave Application N Application Application Attacker Application N Operating System Operating System NIC NIC CPU MMU DRAM DRAM Isolation NIC: Network Interface Controller Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11 – 15, 2018 MMU: Memory Management Unit

Run-time Attacks Inside the Enclave

SGX SDK and The Guard’s Dilemma App Enclave Source Function 0 Function 1 Function 2 Function 3 Compiler Trusted Runtime System (tRTS) Untrusted Runtime System (uRTS) App-to-Enclave SGX function call SDK (ECALL) App Code [Biondo et al., USENIX Sec. 2018] Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11 – 15, 2018

SGX SDK and The Guard’s Dilemma App Enclave Function 0 Function 1 Function 2 Function 3 State Trusted Runtime System (tRTS) [Biondo et al., USENIX Sec. 2018] Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

SGX SDK and The Guard’s Dilemma App Enclave Function 0 Function 1 Function 2 Function 3 State Trusted Runtime System (tRTS) Restore State [Biondo et al., USENIX Sec. 2018] Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

SGX SDK and The Guard’s Dilemma App Enclave Function 0 Function 1 Function 2 Function 3 State Trusted Runtime System (tRTS) Restore State [Biondo et al., USENIX Sec. 2018] Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

SGX SDK and The Guard’s Dilemma App Enclave Function 0 Function 1 Function 2 Function 3 State Trusted Runtime System (tRTS) Counterfeit Restore State state [Biondo et al., USENIX Sec. 2018] Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

SGX SDK and The Guard’s Dilemma App Enclave Function 0 Function 1 Function 2 Function 3 State Trusted Runtime System (tRTS) Counterfeit Restore State state [Biondo et al., USENIX Sec. 2018] Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Leakage in Intel’s SGX Summer School on real-world crypto and privacy, Šibenik (Croatia), June 11 – 15, 2018

Page Fault lt Attacks on SGX Granularity: page 4K, good for big data structures Enclave 1 Enclave 2 App 1 App 2 App 3 OS CPU RAM EPC EPC: Enclave Page Cache PT: Page Tables Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 PF: Page-Fault

Page Fault lt Attacks on SGX Granularity: page 4K, good for big data structures Enclave 1 Enclave 2 App 1 App 2 App 3 OS PT PT CPU RAM EPC EPC: Enclave Page Cache PT: Page Tables Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 PF: Page-Fault

Page Fault lt Attacks on SGX Granularity: page 4K, good for big data structures Enclave 1 Enclave 2 App 1 App 2 App 3 OS PF Handler PT PT IRQ CPU RAM EPC EPC: Enclave Page Cache PT: Page Tables Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 PF: Page-Fault

Page Fault lt Attacks on SGX Granularity: page 4K, good for big data structures Original Recovered Enclave 1 Enclave 2 App 1 App 2 App 3 OS PF Handler PT PT IRQ CPU RAM EPC [Xu et al., IEEE S&P’15] EPC: Enclave Page Cache PT: Page Tables Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 PF: Page-Fault

Page Fault lt Attacks on SGX Granularity: page 4K, good for big data structures Original Recovered Enclave 1 Enclave 2 App 1 App 2 App 3 Single-trace RSA key recovery from RSA key generation OS PF Handler PT PT procedure of Intel SGX SSL via controlled-channel attack on the binary Euclidean algorithm (BEA) IRQ CPU [ Weiser et al., AsiaCCS’18] RAM EPC [Xu et al., IEEE S&P’15] EPC: Enclave Page Cache PT: Page Tables Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 PF: Page-Fault

Cache Attacks on SGX: : Hack in in The Box Enclave 1 Enclave 2 App 1 App 2 App 3 CPU Cache RAM EPC Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 EPC: Enclave Page Cache

Cache Attacks on SGX: : Hack in in The Box Enclave 1 Enclave 2 App 1 App 2 App 3 CPU Cache RAM EPC Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 EPC: Enclave Page Cache

Cache Attacks on SGX: : Hack in in The Box Enclave 1 Enclave 2 App 1 App 2 App 3 observe uses CPU Cache RAM EPC Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 EPC: Enclave Page Cache

Sid ide-Channel l Attacks Basic ics: Prim ime + Probe Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Cache-based Sid ide-Channel l Attacks Prim ime + Probe Prime Victim Probe if (keybit[i] == 0) For each cline Z for each cline Z Code write(Z) read(X) read(Z) else measure_time(read) read(Y) cache line 0 cache line 0 cache line 0 cache line 0 cache line 1 cache line 1 cache line 1 cache line 1 Cache cache line 2 cache line 2 cache line 2 cache line 2 cache line 2 cache line 3 cache line 3 cache line 3 cache line 3 cache line 4 cache line 4 cache line 4 cache line 4 cache line 5 cache line 5 cache line 5 cache line 5 t 0 t 1 t 2 Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Cache-based Sid ide-Channel l Attacks Prim ime + Probe Prime Victim Probe if (keybit[i] == 0) For each cline Z for each cline Z Code write(Z) read(X) read(Z) else measure_time(read) read(Y) cache line 0 cache line 0 cache line 0 cache line 1 cache line 1 cache line 1 Cache cache line 2 cache line 2 cache line 2 cache line 2 cache line 3 cache line 3 cache line 3 cache line 4 cache line 4 cache line 4 cache line 5 cache line 5 cache line 5 t 0 t 1 t 2 Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Cache-based Sid ide-Channel l Attacks Prim ime + Probe Prime Victim Probe if (keybit[i] == 0) For each cline Z for each cline Z Code write(Z) read(X) read(Z) else measure_time(read) read(Y) cache line 0 cache line 0 cache line 0 cache line 1 cache line 1 cache line 1 Cache cache line 2 cache line 2 cache line 2 cache line 2 cache line 3 cache line 3 cache line 3 cache line 4 cache line 4 cache line 4 cache line 5 cache line 5 cache line 5 t 0 t 1 t 2 Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Cache-based Sid ide-Channel l Attacks Prim ime + Probe Prime Victim Probe if (keybit[i] == 0) For each cline Z for each cline Z Code write(Z) read(X) read(Z) else measure_time(read) read(Y) cache line 0 cache line 0 cache line 0 cache line 1 cache line 1 cache line 1 Cache cache line 2 cache line 2 cache line 2 cache line 2 cache line 3 cache line 3 cache line 3 cache line 4 cache line 4 cache line 4 cache line 5 cache line 5 cache line 5 t 0 t 1 t 2 Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Cache-based Sid ide-Channel l Attacks cache line 2 Prim ime + Probe was used by victim Prime Victim Probe if (keybit[i] == 0) For each cline Z for each cline Z Code write(Z) read(X) read(Z) else measure_time(read) read(Y) cache line 0 cache line 0 cache line 0 cache line 1 cache line 1 cache line 1 Cache cache line 2 cache line 2 cache line 2 cache line 3 cache line 3 cache line 3 cache line 4 cache line 4 cache line 4 cache line 5 cache line 5 cache line 5 t 0 t 1 t 2 Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Sid ide-Channel Attacker Challe lenge: Nois ise • “Classical” scenario: unprivileged attacker • OS* is not collaborating with the attacker • OS can directly access process memory containing the victim’s secret • System operates normally, impacting the caches (process scheduling, context switches, interrupts, etc.) Probe Prime Other Process Victim cl 0 cl 0 cl 0 cl 0 cl 0 cl 0 cl 1 cl 1 cl 1 cl 1 cl 1 cl 2 cl 2 cl 2 cl 2 cl 2 cl 2 t k t l t m t n *OS: Operating System and any other privileged system software Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Sid ide-Channel Attacker Challe lenge: Nois ise • “Classical” scenario: unprivileged attacker • OS* is not collaborating with the attacker • OS can directly access process memory containing the victim’s secret • System operates normally, impacting the caches (process scheduling, context switches, interrupts, etc.) Probe Prime Other Process Victim cl 0 cl 0 cl 0 cl 0 cl 0 cl 1 cl 1 cl 1 cl 1 cl 2 cl 2 cl 2 cl 2 cl 2 t k t l t m t n *OS: Operating System and any other privileged system software Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Sid ide-Channel Attacker Challe lenge: Nois ise • “Classical” scenario: unprivileged attacker • OS* is not collaborating with the attacker • OS can directly access process memory containing the victim’s secret • System operates normally, impacting the caches (process scheduling, context switches, interrupts, etc.) Probe Prime Other Process Victim cl 0 cl 0 cl 0 cl 0 cl 0 cl 0 cl 1 cl 1 cl 1 cl 1 cl 2 cl 2 cl 2 cl 2 cl 2 t k t l t m t n *OS: Operating System and any other privileged system software Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Sid ide-Channel Attacker Challe lenge: Nois ise • “Classical” scenario: unprivileged attacker • OS* is not collaborating with the attacker • OS can directly access process memory containing the victim’s secret • System operates normally, impacting the caches (process scheduling, context switches, interrupts, etc.) Probe Prime Other Process Victim cl 0 cl 0 cl 0 cl 0 cl 0 cl 0 cl 1 cl 1 cl 1 cl 1 cl 2 cl 2 cl 2 cl 2 cl 2 t k t l t m t n *OS: Operating System and any other privileged system software Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Sid ide-Channel Attacker Challe lenge: Nois ise • “Classical” scenario: unprivileged attacker • OS* is not collaborating with the attacker • OS can directly access process memory containing the victim’s secret • System operates normally, impacting the caches (process scheduling, context switches, interrupts, etc.) Probe Prime Other Process Victim cl 0 cl 0 cl 0 cl 0 cl 0 cl 1 cl 1 cl 1 cl 1 cl 2 cl 2 cl 2 cl 2 t k t l t m t n *OS: Operating System and any other privileged system software Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Sid ide-Channel Attacker Challe lenge: Nois ise • “Classical” scenario: unprivileged attacker • OS* is not collaborating with the attacker • OS can directly access process memory containing the victim’s secret • System operates normally, impacting the caches (process scheduling, context switches, interrupts, etc.) cl0 and cl2 were used… Probe Prime Other Process Victim … by the cl 0 cl 0 cl 0 cl 0 cl 0 victim? cl 1 cl 1 cl 1 cl 1 cl 2 cl 2 cl 2 cl 2 t k t l t m t n *OS: Operating System and any other privileged system software Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Cache Attacks on SGX Enclave 1 Enclave 2 App 2 App 3 OS SMT SMT CPU Core Level 1 Branch Pred. Level 2 CPU Level 3 RAM EPC EPC: Enclave Page Cache Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 SMT: Simultaneous Multithreading

Cache Attacks on SGX Enclave 1 Enclave 2 App 2 App 3 OS SMT SMT CPU Core Level 1 Branch Pred. Level 2 CPU Level 3 RAM EPC EPC: Enclave Page Cache Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 SMT: Simultaneous Multithreading

Cache Attacks on SGX Enclave 1 Enclave 2 App 2 App 3 Use CPU internal caches to infer OS control flow SMT SMT [Lee et al., Usenix Sec’17] & CPU Core Level 1 Branch Pred. [arXiv:1611.06952] Level 2 CPU Level 3 RAM EPC EPC: Enclave Page Cache Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 SMT: Simultaneous Multithreading

Cache Attacks on SGX Enclave 1 Enclave 2 App 2 App 3 Use CPU internal caches to infer OS control flow SMT SMT [Lee et al., Usenix Sec’17] & CPU Core Level 1 Branch Pred. [arXiv:1611.06952] Level 2 CPU Level 3 Use standard prime + probe to detect key dependent memory Use prime + probe to extract key accesses, interrupt enclave from synchronized victim enclave RAM EPC [Moghimi et al., arXiv:1703.06986] [Götzfried et al., EuroSec’17] EPC: Enclave Page Cache Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 SMT: Simultaneous Multithreading

Cache Attacks on SGX A malicious enclave prime + probes another enclave, evading detection [Schwarz et al., DIMVA’17 & arXiv:1702.08719] Enclave 1 Enclave 2 App 2 App 3 Use CPU internal caches to infer OS control flow SMT SMT [Lee et al., Usenix Sec’17] & CPU Core Level 1 Branch Pred. [arXiv:1611.06952] Level 2 CPU Level 3 Use standard prime + probe to detect key dependent memory Use prime + probe to extract key accesses, interrupt enclave from synchronized victim enclave RAM EPC [Moghimi et al., arXiv:1703.06986] [Götzfried et al., EuroSec’17] EPC: Enclave Page Cache Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 SMT: Simultaneous Multithreading

Cache Attacks on SGX A malicious enclave prime + probes another enclave, evading detection [Schwarz et al., DIMVA’17 & arXiv:1702.08719] Enclave 1 Enclave 2 App 2 App 3 Use CPU internal caches to infer OS control flow SMT SMT [Lee et al., Usenix Sec’17] & CPU Core Level 1 Branch Pred. [arXiv:1611.06952] Our attack: prime + probe attack from Level 2 CPU malicious OS extracting genome data [Brasser et al., WOOT’17] Level 3 Use standard prime + probe to detect key dependent memory Use prime + probe to extract key accesses, interrupt enclave from synchronized victim enclave RAM EPC [Moghimi et al., arXiv:1703.06986] [Götzfried et al., EuroSec’17] EPC: Enclave Page Cache Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018 SMT: Simultaneous Multithreading

SGX Sid ide-Channel Attacks Comparison Observed Interrupting Cache Eviction Attacker Attacked Attack Type Cache Victim Measurement Code Victim Branch Execution RSA & SVM Lee et al. BTB / LBR Yes OS Shadowing Timing classifier Prime + Moghimi et al. L1(D) Yes Access timing OS AES Probe Prime + Götzfried et al. L1(D) No PCM OS AES Probe RSA & Prime + Our Attack L1(D) No PCM OS Genome Probe Sequencing Prime + Counting Schwarz et al. L3 No Enclave AES Probe Thread PCM: Performance Counter Monitor BTB: Branch Target Buffer LBR: Last Branch Record Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Process Process Process Process Process Attacker Victim m+1 m 1 2 n APIC: Advanced Programmable Interrupt Controller OS PCM: Performance Counter Monitor SMT: Simultaneous Multithreading SMT SMT SMT SMT PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Process Process Process Process Process Attacker Victim m+1 m 1 2 n APIC: Advanced Programmable Interrupt Controller OS PCM: Performance Counter Monitor SMT: Simultaneous Multithreading SMT SMT SMT SMT PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Process Process Process Process Process Attacker Victim m+1 m 1 2 n APIC: Advanced Programmable Interrupt Controller OS PCM: Performance Counter Monitor SMT: Simultaneous Multithreading SMT SMT SMT SMT PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Modified Linux scheduler to exclude one core Process Process Process Process Process Attacker Victim (two threads) from assigning task m+1 m • 1 2 n Attacker assigns victim enclave to first SMT thread APIC: Advanced Programmable Interrupt Controller • Attacker assigns Prime+Probe code to second SMT thread OS PCM: Performance Counter Monitor SMT: Simultaneous Multithreading SMT SMT SMT SMT PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Process Process Process Process Process Attacker Victim m+1 m 1 2 n APIC: Advanced Programmable Interrupt Controller OS Handler Handler Handler Handler PCM: Performance Counter Monitor SMT: Simultaneous Multithreading SMT SMT SMT SMT APIC PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Process Process Process Process Process Attacker Victim m+1 m 1 2 n APIC: Advanced Programmable Interrupt Controller OS Handler Handler PCM: Performance Counter Monitor SMT: Simultaneous Multithreading SMT SMT SMT SMT APIC PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Process Process Process Process Process Attacker Victim m+1 m 1 2 n APIC: Advanced Programmable Interrupt Controller Use kernel sysfs interface to assign interrupts to other cores • Timer interrupt (per thread) cannot be reassigned • Lowered timer frequency to 100Hz (i.e., every 10ms) OS Handler Handler PCM: Performance Counter Monitor SMT: Simultaneous Multithreading SMT SMT SMT SMT APIC PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Process Process Process Process Process Attacker Victim m+1 m 1 2 n APIC: Advanced Programmable Interrupt Controller OS Handler Handler PCM: Performance Counter Monitor SMT: Simultaneous Multithreading Probe SMT SMT SMT SMT APIC PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Our Attack [Brasser et al., WOOT’17] Process Process Process Process Process Attacker Victim m+1 m 1 2 n APIC: Advanced Programmable Interrupt Controller OS Handler Handler PCM: Performance Counter Monitor Prime+Probe attack using L1 data cache SMT: Simultaneous Multithreading Probe • Eviction detection using Performance Counter Monitor (L1D_REPLACEMENT) • SMT SMT Anti Side-Channel Interference (ASCI) not effective, SMT SMT monitoring cache events of attacker possible APIC PCM L1 L1 Core 0 Core n Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018

Spatial vs. Temporal Resolution Victim Enclave Cache Attacker while ( i > 0) { prime() { PC PC prepare(); write_cache(); x = table[secret]; } wait(); Probe() { process(x); test_evic(); } } Summer School on real- world crypto and privacy, Šibenik (Croatia), June 11– 15, 2018