All Secrets Great and Small

Abstract

Abstract. Tools for analysing secure information flow are almost exclusively based on ideas going back to Denning's work from the 70's. This approach embodies an imperfect notion of security which turns a blind eye to information flows which are encoded in the termination behaviour of a program. In exchange for this weakness many more programs are deemed "secure", using conditions which are easy to check. Previously it was thought that such leaks are limited to at most one bit per run. Recent work by Askarov et al (ESORICS'08) offers some bad news and some good news: the bad news is that for programs which perform output, the amount of information leaked by a Denning style analysis is not bounded; the good news is that if secrets are chosen to be sufficiently large and sufficiently random then they cannot be effectively leaked at all. The problem addressed in this paper is that secrets cannot always be made sufficiently large or sufficiently random. Contrast, for example, an encryption key with an "hasHIV"-field of a patient record. In recognition of this we develop a notion of secret-sensitive noninterference in which "small" secrets are handled more carefully than "big" ones. We illustrate the idea with a type system which combines a liberal Denning-style analysis with a more restrictive system according to the nature of the secrets at hand.

Match It or Die: Proving Integrity by Equality

“…We first observe that if the entropy of the hashed value is low an attacker might try to compute, by brute force, the hash of all the possible values until he finds a match. We thus select, as our starting point, a recent noninterference variant called secret-sensitive noninterference [6] which distinguishes small and big secrets and allows us to treat their corresponding digests accordingly. If a secret is big, meaning that it is infeasible to guess its actual value, then the brute force attack above is also infeasible.…”

“…In Section 2 we give the background on secretsensitive noninterference [6]; Section 3 extends the noninterference notions so to correctly deal with hash functions. Integrity check by equality is analyzed in Section 4.…”

“…Secret-sensitive noninterference (SSNI) [6], by Demange and Sands, is a variant of noninterference which distinguishes small, guessable secrets from big, unguessable ones. As discussed in the introduction, this distinction will be useful to discipline the downgrading of digests of secret values, as we will see in Section 3.…”

“…The main idea of SSNI [6] is that for unguessable secrets, brute force attacks will terminate only with negligible probability. Intuitively, this allows for adopting a termination insensitive equivalence notion when comparing program behaviour.…”

“…The proposed solution is based on the type system by Demange and Sands [6]. We only report typing rules for expressions and integrity check commands.…”