Brutus: Refuting the Security Claims of the Cache Timing Randomization Countermeasure Proposed in CEASER

Bodduna, Rahul; Ganesan, Vinod; Slpsk, Patanjali; Kamakoti, V.; Rebeiro, Chester

doi:10.1109/lca.2020.2964212

Cited by 25 publications

(20 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…4) Shortcuts: With a case study on CEASER-S, we show with devastating consequences that the security of the randomization should not be taken for granted, even if its output is not directly observable. A similar study was conducted in concurrent work [5]. Instantiating a sound cryptographic algorithm thwarts all shortcuts but affects performance.…”

Section: A Prime+prune+probe On Specific Designsmentioning

confidence: 92%

See 1 more Smart Citation

Systematic Analysis of Randomization-based Protected Cache Architectures

Purnal

Giner

Gruss

et al. 2021

2021 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Recent secure cache designs aim to mitigate sidechannel attacks by randomizing the mapping from memory addresses to cache sets. As vendors investigate deployment of these caches, it is crucial to understand their actual security.In this paper, we consolidate existing randomization-based secure caches into a generic cache model. We then comprehensively analyze the security of existing designs, including CEASER-S and SCATTERCACHE, by mapping them to instances of this model. We tailor cache attacks for randomized caches using a novel PRIME+PRUNE+PROBE technique, and optimize it using burst accesses, bootstrapping, and multi-step profiling. PRIME+ PRUNE+PROBE constructs probabilistic but reliable eviction sets, enabling attacks previously assumed to be computationally infeasible. We also simulate an end-to-end attack, leaking secrets from a vulnerable AES implementation. Finally, a case study of CEASER-S reveals that cryptographic weaknesses in the randomization algorithm can lead to a complete security subversion.Our systematic analysis yields more realistic and comparable security levels for randomized caches. As we quantify how design parameters influence the security level, our work leads to important conclusions for future work on secure cache designs.

show abstract

Section: A Prime+prune+probe On Specific Designsmentioning

confidence: 92%

“…The LLC slicing function can be encapsulated in R (i.e., one randomized cache), or not (i.e., per-slice randomized caches). 5 The randomized cache is divided into P partitions, where 1 ≤ P ≤ n w . An input address a has, in general, a different index in each of these partitions.…”

Section: A Randomization-based Protected Cache Modelmentioning

confidence: 99%

Systematic Analysis of Randomization-based Protected Cache Architectures

Purnal

Giner

Gruss

et al. 2021

2021 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…Our analysis focuses on investigating the fundamental problems in the randomization schemes used by randomly mapped caches. Prior work [30] has shown that the mapping function used in CEASER [9] and Skewed-CEASER [10] only consists of linear functions and has a key invariant vulnerability, that is, changing the key used in the mapping function cannot change the collisions between addresses. This vulnerability can be fixed using non-linear hash functions.…”

Section: Threat Model and Scopementioning

confidence: 99%

“…This vulnerability can be fixed using non-linear hash functions. Note that, our analysis is independent of which hash function is used and studies new vulnerabilities that have not been explored in prior work [30]. Indeed, we focus on analyzing the fundamental problem that is intrinsic to randomly mapped caches.…”

Section: Threat Model and Scopementioning

confidence: 99%

CaSA: End-to-end Quantitative Security Analysis of Randomly Mapped Caches

Bourgeat¹,

Drean²,

Yang

et al. 2020

2020 53rd Annual IEEE/ACM International Symposium on Microarchitecture (MICRO)

View full text Add to dashboard Cite

It is well known that there are micro-architectural vulnerabilities that enable an attacker to use caches to exfiltrate secrets from a victim. These vulnerabilities exploit the fact that the attacker can detect cache lines that were accessed by the victim. Therefore, architects have looked at different forms of randomization to thwart the attacker's ability to communicate using the cache. The security analysis of those randomly mapped caches is based upon the increased difficulty for the attacker to determine the addresses that touch the same cache line that the victim has accessed.In this paper, we show that the analyses used to evaluate those schemes were incomplete in various ways. For example, they were incomplete because they only focused on one of the steps used in the exfiltration of secrets. Specifically, the step that the attacker uses to determine the set of addresses that can monitor the cache lines used by the transmitter address. Instead, we broaden the analysis of micro-architecture side channels by providing an overall view of the communication process. This allows us to identify the existence of other communication steps that can also affect the security of randomly mapped caches, but have been ignored by prior work.We design an analysis framework, CaSA, to comprehensively and quantitatively analyze the security of these randomly mapped caches. We comprehensively consider the end-to-end communication steps and study the statistical relationship between different steps. In addition, to perform quantitative analysis, we leverage the concepts from the field of telecommunications to formulate the security analysis into a statistical problem. We use CaSA to evaluate a wide range of attack strategies and cache configurations. Our result shows that the randomization mechanisms used in the state-of-the-art randomly mapped caches are insecure.Index Terms-Micro-architecture side channel, randomly mapped cache, security analysis.

show abstract

“…While these defenses were shown effective against the eviction set construction algorithms and techniques at the time, subsequent more efficient eviction set construction algorithms [80] were able to undermine them. Consequently, enhancements to these defenses were proposed [80], only to be rendered ineffective again by yet another attack vector, e.g., weak low-latency cryptographic primitives [76], [10], or alternative attack techniques that exploited design/implementation flaws in the proposed defenses [88].…”

Section: Introductionmentioning

confidence: 99%

Chunked-Cache: On-Demand and Scalable Cache Isolation for Security Architectures

Dessouky¹,

Gruler²,

Mahmoody³

et al. 2021

Preprint

View full text Add to dashboard Cite

Shared cache resources in multi-core processors are vulnerable to cache side-channel attacks. Recently proposed defenses such as randomized mapping of addresses to cache lines or well-known cache partitioning have their own caveats: Randomization-based defenses have been shown vulnerable to newer attack algorithms besides relying on weak cryptographic primitives. They do not fundamentally address the root cause for cache side-channel attacks, namely, mutually distrusting codes sharing cache resources. Cache partitioning defenses provide the strict resource partitioning required to effectively block all side-channel threats. However, they usually rely on way-based partitioning which is not fine-grained and cannot scale to support a larger number of protection domains, e.g., in trusted execution environment (TEE) security architectures, besides degrading performance and often resulting in cache underutilization.To overcome the shortcomings of both approaches, we present a novel and flexible set-associative cache partitioning design for TEE architectures, called CHUNKED-CACHE. The core idea of CHUNKED-CACHE is to enable an execution context to "carve" out an exclusive configurable chunk of the cache if the execution requires side-channel resilience. If side-channel resilience is not required, mainstream cache resources can be freely utilized. Hence, our solution CHUNKED-CACHE addresses the securityperformance trade-off practically by enabling efficient selective and on-demand utilization of side-channel-resilient caches, while providing well-grounded future-proof security guarantees. We show that CHUNKED-CACHE provides side-channel-resilient cache utilization for sensitive code execution, with small hardware overhead, while incurring no performance overhead on the OS. We also show that it outperforms conventional way-based cache partitioning by 43%, while scaling significantly better to support a larger number of protection domains.

show abstract

Brutus: Refuting the Security Claims of the Cache Timing Randomization Countermeasure Proposed in CEASER

Cited by 25 publications

References 9 publications

Systematic Analysis of Randomization-based Protected Cache Architectures

Systematic Analysis of Randomization-based Protected Cache Architectures

CaSA: End-to-end Quantitative Security Analysis of Randomly Mapped Caches

Chunked-Cache: On-Demand and Scalable Cache Isolation for Security Architectures

Contact Info

Product

Resources

About