TY - GEN
T1 - Safecracker
T2 - 25th International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS 2020
AU - Tsai, Po An
AU - Sanchez, Andres
AU - Fletcher, Christopher W.
AU - Sanchez, Daniel
N1 - Funding Information:
We sincerely thank Maleen Abeydeera, Joel Emer, Mark Jeffrey, Anurag Mukkara, Quan Nguyen, Victor Ying, Guowei Zhang, and the anonymous reviewers for their feedback. We thank Joel Emer for his insights on the taxonomy in Sec. 2. We thank Paul Kocher for sharing his concerns about the security of memory compression. This work was supported in part by NSF grants CAREER-1452994 and SaTC-1816226, a Google faculty research award, and an Intel ISRA grant. Andres Sanchez was supported by a MISTI grant by the Technical University of Madrid.
Publisher Copyright:
© 2020 Copyright held by the owner/author(s). Publication rights licensed to ACM.
PY - 2020/3/9
Y1 - 2020/3/9
N2 - The hardware security crisis brought on by recent speculative execution attacks has shown that it is crucial to adopt a security-conscious approach to architecture research, analyzing the security of promising architectural techniques before they are deployed in hardware. This paper offers the first security analysis of cache compression, one such promising technique that is likely to appear in future processors. We find that cache compression is insecure because the compressibility of a cache line reveals information about its contents. Compressed caches introduce a new side channel that is especially insidious, as simply storing data transmits information about it. We present two techniques that make attacks on compressed caches practical. Pack+Probe allows an attacker to learn the compressibility of victim cache lines, and Safecracker leaks secret data efficiently by strategically changing the values of nearby data. Our evaluation on a proof-of-concept application shows that, on a common compressed cache architecture, Safecracker lets an attacker compromise a secret key in under 10 ms, and worse, leak large fractions of program memory when used in conjunction with latent memory safety vulnerabilities. We also discuss potential ways to close this new compression-induced side channel. We hope this work prevents insecure cache compression techniques from reaching mainstream processors.
AB - The hardware security crisis brought on by recent speculative execution attacks has shown that it is crucial to adopt a security-conscious approach to architecture research, analyzing the security of promising architectural techniques before they are deployed in hardware. This paper offers the first security analysis of cache compression, one such promising technique that is likely to appear in future processors. We find that cache compression is insecure because the compressibility of a cache line reveals information about its contents. Compressed caches introduce a new side channel that is especially insidious, as simply storing data transmits information about it. We present two techniques that make attacks on compressed caches practical. Pack+Probe allows an attacker to learn the compressibility of victim cache lines, and Safecracker leaks secret data efficiently by strategically changing the values of nearby data. Our evaluation on a proof-of-concept application shows that, on a common compressed cache architecture, Safecracker lets an attacker compromise a secret key in under 10 ms, and worse, leak large fractions of program memory when used in conjunction with latent memory safety vulnerabilities. We also discuss potential ways to close this new compression-induced side channel. We hope this work prevents insecure cache compression techniques from reaching mainstream processors.
KW - Cache
KW - Compression
KW - Security
KW - Side channel
UR - http://www.scopus.com/inward/record.url?scp=85082385315&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85082385315&partnerID=8YFLogxK
U2 - 10.1145/3373376.3378453
DO - 10.1145/3373376.3378453
M3 - Conference contribution
AN - SCOPUS:85082385315
T3 - International Conference on Architectural Support for Programming Languages and Operating Systems - ASPLOS
SP - 1125
EP - 1140
BT - ASPLOS 2020 - 25th International Conference on Architectural Support for Programming Languages and Operating Systems
PB - Association for Computing Machinery
Y2 - 16 March 2020 through 20 March 2020
ER -