[e-lang] Side Channels (was: E-on-Common-Lisp now available)
digitale at digitaleric.net
Tue May 24 15:02:56 EDT 2005
On Sat, 2005-05-21 at 18:32, David Wagner wrote:
> I'm unconvinced. I'm happy to discount intentional covert channels.
> Instead, I want to focus on unintentional side channels. Suppose Alice
> and Bob, two mutually distrusting objects, are sharing the same cache.
> If the cache uses weak pointers, then information about Alice's use
> of the cache can leak to Bob. That might violate Alice's security, if
> Alice's access pattern was intended to be secret. This is true even if
> the cache is non-malicious.
> Saying that the attack doesn't work if Bob has no access to
> non-determinism is not a useful answer in practice, because that is
> not something Alice has control over. At a minimum, we want to give
> Alice everything she needs to protect herself; at a maximum, we want
> to minimize the number of unexpected security pitfalls associated with
> natural programming idioms (such as caches, weak pointers, etc.).
I know David Wagner is already aware of this, but I thought I'd put in a
link for the archives, since MarkM asked me to:
Colin Percival has recently (<2 weeks ago) presented an attack to steal
crypto keys by timing memory accesses to see which are in the CPU's
http://www.daemonology.net/hyperthreading-considered-harmful/ or the
usenet discussion on comp.arch and sci.crypt rooted in a message
"Hyper-Threading Considered Harmful" by Colin sent Fri, 13 May 2005
00:00:56 +0000 (UTC) ) for details. In principle, these attacks do
not depend on HyperThreading, and would apply even to a single-CPU
machines, though it would be much more difficult to pull it off there.
> I don't know whether E ever made any explicit claims about this,
> but I don't think that gets us off the hook. It is a security risk.
> The question is: Should E protect against this? What are the guidelines
> we give to programmers to enable them to protect themselves against
> this risk?
E is not in good a position to make claims when running on information-
leaking hardware or software.
More information about the e-lang