CT-wasm: type-driven secure cryptography for the web ecosystem

Abstract

A significant amount of both client and server-side cryptography is implemented in JavaScript. Despite widespread concerns about its security, no other language has been able to match the convenience that comes from its ubiquitous support on the "web ecosystem"-the wide variety of technologies that collectively underpins the modern World Wide Web. With the introduction of the new WebAssembly bytecode language (Wasm) into the web ecosystem, we have a unique opportunity to advance a principled alternative to existing JavaScript cryptography use cases which does not compromise this convenience.We present Constant-Time WebAssembly (CT-Wasm), a type-driven, strict extension to WebAssembly which facilitates the verifiably secure implementation of cryptographic algorithms. CT-Wasm's type system ensures that code written in CT-Wasm is both information flow secure and resistant to timing side channel attacks; like base Wasm, these guarantees are verifiable in linear time. Building on an existing Wasm mechanization, we mechanize the full CT-Wasm specification, prove soundness of the extended type system, implement a verified type checker, and give several proofs of the language's security properties.We provide two implementations of CT-Wasm: an OCaml reference interpreter and a native implementation for Node.js and Chromium that extends Google's V8 engine. We also implement a CT-Wasm to Wasm rewrite tool that allows developers to reap the benefits of CT-Wasm's type system today, while developing cryptographic algorithms for base Wasm environments. We evaluate the language, our implementations, and supporting tools by porting several cryptographic primitives-Salsa20, SHA-256, and TEA-and the full TweetNaCl library. We find that CT-Wasm is fast, expressive, and generates code that we experimentally measure to be constant-time.

FaCT: a DSL for timing-sensitive computation

“…Like previous information-flow type systems [42,43,55,62], FaCT decorates each base type with a secret or public secrecy label 2 . Figure 2 summarizes our base types; they are largely standard.…”

“…where ≡ is a suitably parametrized notion of equivalence (e.g., public or łlowž equivalence [5,9,62]).…”

“…Much like CT-Wasm [62], we cannot prove that all FaCT procedures are constant-timeÐFaCT allows procedures to declassify secret data and call external procedures over which it has no control. We can, however, provide guarantees for a safe subset of declassify-free procedures, i.e., procedures that do not contain any declassify statements nor call other procedures unless they too are declassify-free (and not extern).…”

“…Several other works concerned with constant-time crypto implementation [8,52,56,62] have reported using dudect. In our testing, we found the tool to quickly and reliably find timing differences in buggy code.…”

Formally Verified Cryptographic Web Applications in WebAssembly

“…We propose to build a validation pass on the WebAssembly code generated from KreMLin to ensure that it preserves the side-channel guarantees proved for the Low * source code. To ensure that these guarantees are preserved all the way to machine code, we hope to eventually connect our toolchain to CT-Wasm [35], a new proposal that advocates for a notion of secrets directly built into the WebAssembly semantics.…”