AI helps you reading Science

AI generates interpretation videos

AI extracts and analyses the key points of the paper to generate videos automatically


pub
Go Generating

AI Traceability

AI parses the academic lineage of this thesis


Master Reading Tree
Generate MRT

AI Insight

AI extracts a summary of this paper


Weibo:
In this paper we describe the FLUSH+RELOAD technique and how we use it to extract GnuPG private keys across multiple processor cores and across virtual machine boundaries

FLUSH+RELOAD: a high resolution, low noise, L3 cache side-channel attack

USENIX Security, (2014): 719-732

Cited by: 1244|Views279
EI
Full Text
Bibtex
Weibo

Abstract

Sharing memory pages between non-trusting processes is a common method of reducing the memory footprint of multi-tenanted systems. In this paper we demonstrate that, due to a weakness in the Intel X86 processors, page sharing exposes processes to information leaks. We present FLUSH+RELOAD, a cache side-channel attack technique that exploi...More

Code:

Data:

0
Introduction
  • To reduce the memory footprint of a system, the system software shares identical memory pages between processes running on the system.
  • Such sharing can be based on the source of the page, as is the case in shared libraries [13, 26, 42].
  • While the processor ensures that processes cannot change the contents of shared memory pages, it sometimes fails to block other forms of inter-process interference.
  • The technique uses the processor’s clflush instruction to evict the monitored memory locations from the cache, and tests whether the data in these locations is back in the cache after allowing the victim program to execute a small number of instructions
Highlights
  • To reduce the memory footprint of a system, the system software shares identical memory pages between processes running on the system
  • While the processor ensures that processes cannot change the contents of shared memory pages, it sometimes fails to block other forms of inter-process interference
  • We describe how we use the FLUSH+RELOAD technique to extract the components of the private key from the GnuPG implementation of RSA
  • In this paper we describe the FLUSH+RELOAD technique and how we use it to extract GnuPG private keys across multiple processor cores and across virtual machine boundaries
Conclusion
  • In this paper the authors describe the FLUSH+RELOAD technique and how the authors use it to extract GnuPG private keys across multiple processor cores and across virtual machine boundaries.

    It is hard to overstate the severity of the attack, both in virtualised and in non-virtualised environments.
  • GnuPG is a very popular cryptographic package.
  • It is used as the cryptography module of many open-source projects and is used, for example, for email, file and communication encryption.
  • The attack on GnuPG is only a demonstration of the power of the FLUSH+RELOAD technique.
  • It can be used to devise other types of attacks on cryptographic software.
  • It can be used against other types of software.
  • It could be used to collect statistical data on network traffic by monitoring network handling code or it could monitor keyboard drivers to collect keystroke timing information
Tables
  • Table1: Time Slots for Bit Sequence
  • Table2: Statistics on Bit Errors in Capture
  • Table3: Statistics on Bit Errors in the Better Captured
Download tables as Excel
Related work
  • Several works have pointed out that page sharing exposes guests to information leakage, which can be exploited for implementing covert channels [58], OS fingerprinting [44] and for detecting applications and data in other guests [49]. These works exploit the copy-on-write feature of page sharing. Copy-on-write introduces a significant delay when a page is copied. Hence, by timing write operations on pages, a spy can deduce the existence of pages with identical contents in other guests. As page de-duplication is a slow process, all these attacks have a very low resolution.

    Using a cache side-channel to trace the execution of a program is not a new idea [1, 2, 4, 14, 19, 29, 61]. In all of these attacks, the victim and the spy must share the execution core, either by using hyper-threading or by interleaving the execution of the victim and the spy on the same core.
Funding
  • Open access to the Proceedings of the 23rd USENIX Security Symposium is sponsored by USENIX
Reference
  • ACIIC MEZ, O. Yet another microarchitectural attack: exploiting I-Cache. In Proceedings of the ACM Workshop on Computer Security Architecture (Fairfax, Virginia, United States, November 2007), P. Ning and V. Atluri, Eds., pp. 11–18.
    Google ScholarLocate open access versionFindings
  • ACIIC MEZ, O., BRUMLEY, B. B., AND GRABHER, P. New results on instruction cache attacks. In Proceedings of the Workshop on Cryptographic Hardware and Embedded Systems (Santa Barbara, California, United States, April 2010), S. Mangard and F.-X. Standaert, Eds., pp. 110–124.
    Google ScholarLocate open access versionFindings
  • ACIIC MEZ, O., KOC, C. K., AND SEIFERT, J.-P. On the power of simple branch prediction analysis. In Proceedings of the Second ACM Symposium on Information, Computer and Communication Security (Singapore, March 2007), pp. 312–320.
    Google ScholarLocate open access versionFindings
  • ACIIC MEZ, O., AND SCHINDLER, W. A vulnerability in RSA implementations due to instruction cache analysis and its demonstration on OpenSSL. In Proceedings of the Cryptographers’ Track at the RSA Conference (San Francisco, California, United States, April 2008), T. Malkin, Ed., pp. 256–273.
    Google ScholarLocate open access versionFindings
  • ACIIC MEZ, O., SCHINDLER, W., AND KOC, C. K. Cache based remote timing attacks on the AES. In Proceedings of the Cryptographers’ Track at the RSA Conference (San Francisco, California, United States, February 2007), M. Abe, Ed., pp. 271–286.
    Google ScholarLocate open access versionFindings
  • ARCANGELI, A., EIDUS, I., AND WRIGHT, C. Increasing memory density by using KSM. In Proceedings of the Linux Symposium (Montreal, Quebec, Canada, July 2009), pp. 19–28.
    Google ScholarLocate open access versionFindings
  • ARM Architecture Reference Manual, ARMv7-A and ARMv7R ed., 2012.
    Google ScholarFindings
  • BARHAM, P., DRAGOVIC, B., FRASER, K., HAND, S., HARRIS, T., HO, A., NEUGEBAUER, R., PRATT, I., AND WARFIELD, A. Xen and the art or virtualization. In Proceedings of the Ninteenth ACM Symposium on Operating Systems Principles (Bolton Landing, New York, United States, October 2003), M. L. Scott and L. L. Peterson, Eds., ACM, pp. 164–177.
    Google ScholarLocate open access versionFindings
  • BERNSTEIN, D. J. Cache-timing attacks on AES. http://cr.yp.to/antiforgery/cachetiming-20050414.pdf, April 2005.
    Findings
  • BERNSTEIN, D. J., LANGE, T., AND SCHWABE, P. The security impact of a new cryptographic library. In Proceedings of the Second International Conference on Cryptology and Information Security in Latin America (Santiago, Chile, October 2012), A. Hevia and G. Neven, Eds., pp. 159–176.
    Google ScholarLocate open access versionFindings
  • BERNSTEIN, D. J., AND SCHWABE, P. A word of warning. CHES 2013 Rump Session, August 2013.
    Google ScholarLocate open access versionFindings
  • BHATKAR, S., DUVARNEY, D. C., AND SEKAR, R. Address obfuscation: an efficient approach to combat a broad range of memory error exploits. In Proceedings of the USENIX Security Symposium (Washington, DC, United States, August 2003), pp. 105–120.
    Google ScholarLocate open access versionFindings
  • BOBROW, D. G., BURCHFIEL, J. D., MURPHY, D. L., AND TOMLINSON, R. S. TENEX, a paged time sharing system for the PDP-10. Communications of the ACM 5, 3 (March 1972), 135–143.
    Google ScholarLocate open access versionFindings
  • BRUMLEY, B. B., AND HAKALA, R. M. Cache-timing template attacks. In Advances in Cryptology - ASIACRYPT 2009 (2009), M. Matsui, Ed., vol. 5912 of Lecture Notes in Computer Science, Springer-Verlag, pp. 667–684.
    Google ScholarLocate open access versionFindings
  • BUGNION, E., DEVINE, S., GOVIL, K., AND ROSENBLUM, M. Disco: Running commodity operating systems on scalable multiprocessors. ACM Transactions on Computer Systems 15, 4 (November 1997), 412–447.
    Google ScholarLocate open access versionFindings
  • CAMPAGNA, M., AND SETHI, A. Key recovery method for CRT implementation of RSA. Report 2004/147, IACR Cryptology ePrint Archive, 2004.
    Google ScholarLocate open access versionFindings
  • CERON, R., FOLCO, R., LEITAO, B., AND TSUBAMOTO, H. Power Systems Memory Deduplication. IBM, September 2012.
    Google ScholarLocate open access versionFindings
  • CERT vulnerability note vu#976534: L3 cpu shared cache architecture is susceptible to a Flush+Reload side-channel attack. http://www.kb.cert.org/vuls/id/976534, October 2013.
    Findings
  • CHEN, C., WANG, T., KOU, Y., CHEN, X., AND LI, X. Improvement of trace-driven I-Cache timing attack on the RSA algorithm. The Journal of Systems and Software 86, 1 (2013), 100– 107.
    Google ScholarLocate open access versionFindings
  • CIPRESSO, T., AND STAMP, M. Software reverse engineering. In Handbook of Information and Communication Security, P. Stavroulakis and M. Stamp, Eds. Springer, 2010, ch. 31, pp. 659–696.
    Google ScholarLocate open access versionFindings
  • CORON, J.-S. Resistence against differential power analysis for elliptic curve cryptosystems. In Proceedings of the Workshop on Cryptographic Hardware and Embedded Systems (Worcester, Massachusetts, United States, August 1999), C. K. Kocand C. Paar, Eds., pp. 292–302.
    Google ScholarLocate open access versionFindings
  • CURTSINGER, C., AND BERGER, E. D. STABILIZER: Statistically sound performance evaluation. In Proceedings of the 18th International Conference on Architectural Support for Programming Languages and Operating Systems (Houston, Texas, United States, March 2013), pp. 219–228.
    Google ScholarLocate open access versionFindings
  • ELGAMAL, T. A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Transactions on Information Theory 31, 4 (July 1985), 469–472.
    Google ScholarLocate open access versionFindings
  • FORREST, S., SOMAYAJI, A., AND ACKLEY, D. H. Building diverse computer systems. In Proceedings of the Sixth Workshop on Hot Topics in Operating Systems (Cape Code, Massachusetts, United States, May 1997), pp. 67–72.
    Google ScholarLocate open access versionFindings
  • GARNER, H. L. The residue number system. IRE Transactions on Electronic Computers EC-8, 2 (June 1959), 140–147.
    Google ScholarFindings
  • GINGELL, R. A., LEE, M., DANG, X. T., AND WEEKS, M. S. Shared libraries in SunOS. In USENIX Conference Proceedings (Phoenix, Arizona, United States, Summer 1987), pp. 131–145.
    Google ScholarLocate open access versionFindings
  • GNU Privacy Guard. http://www.gnupg.org, 2013.
    Findings
  • [45] PAOLONI, G. How to Benchmark Code Execution Times on Intel
    Google ScholarFindings
  • [28] GORDON, D. M. A survey of fast exponentiation methods. Journal of Algorithms 27, 1 (April 1998), 129–146. IA-32 and IA-64 Instruction Set Architectures. Intel Corporation, September 2010.
    Google ScholarLocate open access versionFindings
  • [29] GULLASCH, D., BANGERTER, E., AND KRENN, S. Cache games — bringing access-based cache attacks on AES to prac-
    Google ScholarFindings
  • [46] PERCIVAL, C. Cache missing for fun and profit. http://www.daemonology.net/papers/htt.pdf, 2005. tice. In Proceedings of the IEEE Symposium on Security and Privacy (Oakland, California, United States, may 2011), pp. 490– 595.
    Locate open access versionFindings
  • [47] RISTENPART, T., TROMER, E., SHACHAM, H., AND SAVAGE, S. Hey, you, get off my cloud: Exploring information leakage in third-party compute clouds. In Proceedings of the 16th ACM
    Google ScholarLocate open access versionFindings
  • [30] HENINGER, N., AND SHACHAM, H. Reconstructing RSA private keys from random key bits. In Proceedings of the 29th Annual International Cryptology Conference (CRYPTO Conference on Computer and Communication Security (Chicago, Illinois, United States, November 2009), E. Al-Shaer, S. Jha, and A. D. Keromytis, Eds., pp. 199–212.
    Google ScholarLocate open access versionFindings
  • 2009) (Santa Barbara, California, United States, August 2009), S. Halevi, Ed., pp. 1–17.
    Google ScholarFindings
  • [48] RIVEST, R. L., SHAMIR, A., AND ADLEMAN, L. A method for obtaining digital signatures and public-key cryptosystems. Com-
    Google ScholarLocate open access versionFindings
  • [31] HERMANN, M., AND MAY, A. Solving linear equations modulo munications of the ACM 21, 2 (February 1978), 120–126. divisors: On factoring given any bits. In Advances in Cryptology - ASIACRYPT 2008 (Melbourne, Australia, December 2008), vol. 5350 of Lecture Notes in Computer Science, pp. 406–424.
    Google ScholarLocate open access versionFindings
  • [32] HU, W.-M. Reducing timing channels with fuzzy time. In Proceedings of the IEEE Symposium on Security and Privacy (Oakland, California, United States, May 1991), pp. 8–20.
    Google ScholarLocate open access versionFindings
  • [49] SUZAKI, K., IIJIMA, K., YAGI, T., AND ARTHO, C. Memory deduplication as a threat to the guest. In Proceedings of the 2011 European Workshop on System Security (Salzburg, Austria, 2011).
    Google ScholarLocate open access versionFindings
  • [50] The PaX project. http://pax.grsecurity.net/.
    Findings
  • [33] HUFFMAN, C. Memory combining in Windows and Windows Server 2012.
    Google ScholarFindings
  • [51] TROMER, E., OSVIK, D. A., AND SHAMIR, A. Efficient cache attacks in AES, and countermeasures. Journal of Cryptology 23, 2 (January 2010), 37–71. memory-combining-in-windows-8-and-windows-server-2012[5.2] UHT, A. K., AND SINDAGI, V. Disjoint eager execution: An aspx, November 2012.
    Google ScholarLocate open access versionFindings
  • optimal form of speculative execution. In Proceedings of the
    Google ScholarLocate open access versionFindings
  • [34] INTEL CORPORATION. Intel 64 and IA-32 Architecture Optimization Reference Manual, April 2012. 28th International Symposium on Microarchitecture (Ann Arbor, Michigan, United States, November 1995), pp. 313–325.
    Google ScholarFindings
  • [35] INTEL CORPORATION. Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 3A: System Programming Guide, Part 1, March 2013.
    Google ScholarLocate open access versionFindings
  • [36] KIL, C., JUN, J., BOOKHOLT, C., XU, J., AND NING, P. Address space layout permutation (aslp): Towards fine-grained randomization of commodity software. In Proceedings of the Annual Computer Security Applications Conference (Miami Beach, Florida, United States, December 2006), pp. 339–348.
    Google ScholarLocate open access versionFindings
  • [37] KIVITY, A., KAMAY, Y., LAOR, D., LUBLIN, U., AND LIGUORI, A. kvm: the Linux virtual machine monitor. In Proceedings of the Linux Symposium (Ottawa, Ontario, Canada, June 2007), vol. one, pp. 225–230.
    Google ScholarLocate open access versionFindings
  • [53] VATTIKONDA, B. C., DAS, S., AND SHACHAM, H. Eliminating fine grained timers in Xen. In Proceedings of the ACM Workshop on Cloud Computing Security (Chicago, Illinois, United States, October 2011), C. Cachin and T. Ristenpart, Eds., pp. 41–46.
    Google ScholarLocate open access versionFindings
  • [54] VMWARE INC. Understanding Memory Resource Management in VMware ESX Server. Palo Alto, California, United States, 2009.
    Google ScholarFindings
  • [55] WALDSPURGER, C. A. Memory resource management in VMware ESX Server. In Proceedings of the Fifth Symposium on Operating Systems Design and Implementation (Boston, Massachusetts, United States, December 2002), D. E. Culler and P. Druschel, Eds., pp. 181–194.
    Google ScholarLocate open access versionFindings
  • [38] KOCH, W. GnuPG 1.4.14 released. http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html, July 2013.
    Findings
  • [39] MIŁOS, G., MURRAY, D. G., HAND, S., AND FETTERMAN, M. A. Satori: Enlightened page sharing. In Proceedings of the 2009 USENIX Annual Technical Conference (San Diego, California, United States, June 2009).
    Google ScholarLocate open access versionFindings
  • [40] MURPHY, D. L. Storage organization and mamagement in TENEX. In Proceedings of the Fall Joint Computer Conference, AFIPS’72, Part I (Anaheim, California, United States, December 1972), pp. 23–32.
    Google ScholarLocate open access versionFindings
  • [41] OPENSSL. http://www.openssl.org.
    Findings
  • [42] ORGANICK, E. I. The Multics System: An Examination of Its Structure. The MIT Press, 1972.
    Google ScholarFindings
  • [43] OSVIK, D. A., SHAMIR, A., AND TROMER, E. Cache attacks and countermeasures: the case of AES. http://www.cs.tau.ac.il/~tromer/papers/cache.pdf, November 2005.
    Findings
  • WALTER, C. D. Longer keys may facilitate side channel attacks. In Selected Areas in Cryptography (2004), M. Matsui and R. J. Zuccherato, Eds., vol. 3006 of Lecture Notes in Computer Science, Springer-Verlag, pp. 42–57.
    Google ScholarLocate open access versionFindings
  • WEISS, M., HEINZ, B., AND STUMPF, F. A cache timing attack on AES in virtualization environments. In Proceedings of the 16th International Conference on Financial Cryptography and Data Security (Bonaire, February 2012), A. D. Keromytis, Ed.
    Google ScholarLocate open access versionFindings
  • XIAO, J., XU, Z., HUANG, H., AND WANG, H. A covert channel construction in virtualized environments. In Proceedings of the 19th ACM Conference on Computer and Communication Security (Raleigh, North Carolina, United States, October 2012), T. Yu, G. Danezis, and V. D. Gligor, Eds., pp. 1040–1042.
    Google ScholarLocate open access versionFindings
  • XU, J., KALBARCZYK, Z., AND IYER, R. K. Transparent runtime randomization for security. In Proceedings of the 22nd International Symposium on Reliable Distributed Systems (Florence, Italy, October 2003), pp. 260–269.
    Google ScholarLocate open access versionFindings
  • [44] OWENS, R., AND WANG, W. Non-interactive OS fingerprinting through memory de-duplication technique in virtual machines. In Proceedings of the 30th IEEE International Performance Computing and Communicatons Conference (Orlando, Florida, United States, November 2011), S. Zhong, D. Dou, and Y. Wang, Eds., IEEE, pp. 1–8.
    Google ScholarLocate open access versionFindings
  • [60] XU, Y., BAILEY, M., JAHANIAN, F., JOSHI, K., HILTUNEN, M., AND SCHLICHTING, R. An exploration of L2 cache covert channels in virtualized environments. In Proceedings of the ACM Workshop on Cloud Computing Security (Chicago, Illinois, United States, October 2011), C. Cachin and T. Ristenpart, Eds., pp. 29–40.
    Google ScholarLocate open access versionFindings
  • [61] ZHANG, Y., JULES, A., REITER, M. K., AND RISTENPART, T. Cross-VM side channels and their use to extract private keys. In Proceedings of the 19th ACM Conference on Computer and Communication Security (Raleigh, North Carolina, United States, October 2012), T. Yu, G. Danezis, and V. D. Gligor, Eds., pp. 305– 316.
    Google ScholarLocate open access versionFindings
Author
Katrina E. Falkner
Katrina E. Falkner
Your rating :
0

 

Tags
Comments
数据免责声明
页面数据均来自互联网公开来源、合作出版商和通过AI技术自动分析结果,我们不对页面数据的有效性、准确性、正确性、可靠性、完整性和及时性做出任何承诺和保证。若有疑问,可以通过电子邮件方式联系我们:report@aminer.cn
小科