From 76bae02bcd7d6b3ec9eea428e5e95da184a8dbfb Mon Sep 17 00:00:00 2001 From: Rasmus Dahlberg Date: Tue, 15 Oct 2024 15:35:20 +0200 Subject: Rescue some slides from old private mono repos --- slides/2019-side-channels/src/body.tex | 536 +++++++++++++++++++++++++++++++++ 1 file changed, 536 insertions(+) create mode 100644 slides/2019-side-channels/src/body.tex (limited to 'slides/2019-side-channels/src/body.tex') diff --git a/slides/2019-side-channels/src/body.tex b/slides/2019-side-channels/src/body.tex new file mode 100644 index 0000000..a2ede47 --- /dev/null +++ b/slides/2019-side-channels/src/body.tex @@ -0,0 +1,536 @@ +\begin{frame} + \mktitle{Learning outcomes} + \begin{columns} + \begin{column}{0.75\textwidth} + \begin{itemize} + \item Understand the threat of side-channels + \item Get an intuition of timing attacks + \end{itemize} + \end{column} + \begin{column}{0.25\textwidth} + \centering + \includegraphics[width=.8\textwidth]{img/meltdown} + \end{column} + \end{columns} + \vfill + \alert{No in-depth programming and cryptographic details} +\end{frame} + +\begin{frame} + \mktitle{Setting and security} + \begin{tikzpicture} + \node[draw=none](server){ + \includegraphics[width=60pt]{img/server} + }; + \node[draw=none,left=100pt of server](client){ + \includegraphics[width=40pt]{img/client} + }; + \path[draw, latex-latex] (client) -- (server); + \end{tikzpicture} +\end{frame} + +\begin{frame} + \mktitle{Security on paper} + \includegraphics[height=.67\textheight]{img/security-door-zoomin} +\end{frame} + +\begin{frame} + \mktitle{Reality --- not a black box} + \includegraphics[height=.67\textheight]{img/security-door-zoomout} +\end{frame} + +\begin{frame} + \mktitle{Side channels --- Pandora's box} + \begin{columns} + \begin{column}{.5\textwidth} + \hfill + \includegraphics[height=.67\textheight]{img/pandora} + \end{column} + \begin{column}{.5\textwidth} + \begin{itemize} + \item Power consumption + \item EM radiation + \item Heat + \item Sound + \item Cache + \item Faults + \item Timing + \item Size + \item ... + % REMINDER@Pandora: ... -> e.g., disk access patterns + \end{itemize} + \end{column} + \end{columns} + % REMINDER@Pandora: sky is the limit, there are lots of things to measure +\end{frame} + +\begin{frame} + \mktitle{Printer sounds --- document content leaked} + \includegraphics[height=.67\textheight]{img/printersound} + \vfill\scriptsize{ + Backes \emph{et~al.}: + Acoustic Side-Channel Attacks on Printers, + In: USENIX Security + (2010) + } +\end{frame} + +\begin{frame} + \mktitle{Laptop sounds --- secret key leaked} + \includegraphics[width=.67\textwidth]{img/ultrasound} + \vfill\scriptsize{ + Genkin \emph{et~al.}: + RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis, + In: Crypto + (2014) + } +\end{frame} + +\begin{frame} + \mktitle{Energy consumption --- secret key leaked} + \includegraphics[width=.67\textwidth]{img/smartcard} + \vfill\scriptsize{ + Messerges \emph{et~al.}: + Power Analysis Attacks of Modular Exponentiation in Smartcards, + In: CHES (1999) + } +\end{frame} + +\begin{frame} + \mktitle{Packet size --- encrypted content leaked} + \includegraphics[height=.67\textheight]{img/voip} + \vfill\scriptsize{ + White \emph{et~al.}: + Phonotactic Reconstruction of Encrypted VoIP Conversations: + Hookt on Fon-iks, + In: IEEE SP + (2011) + } +\end{frame} + +\begin{frame} + \mktitle{Response timing --- message forgery} + \begin{tikzpicture} + \node[draw=none](server){ + \includegraphics[width=60pt]{img/server} + }; + \node[draw=none,left=100pt of server](client){ + \includegraphics[width=40pt]{img/attacker} + }; + \path[draw, -latex] + (client.34) |- + node[draw=none,above,pos=.75]{\texttt{msg, tag}} + (server.155); + \path[draw, -latex] + (server.199) |- + node[draw=none,above,pos=.75]{\texttt{yes/no}} + (client.335); + \end{tikzpicture} + \vfill\scriptsize{ + Crosby \emph{et al.}: + Opportunities and Limits of Remote Timing Attacks, + In: TISSEC + (2009) + }\\ + \scriptsize{ + Hale: + A lesson in timing attacks, + URL: \url{https://codahale.com/a-lesson-in-timing-attacks/} + (2009) + } +\end{frame} + +\begin{frame} + \mktitle{Scope} + \begin{tikzpicture} + \node[draw,rectangle, + minimum width=.6\textwidth, + minimum height=.4\textheight, + fill=gray!33, + ](sc){}; + \node[draw=none,below=0pt of sc.150]{side-channels}; + \node[draw,circle, + minimum width=.15\textwidth, + fill=rgdGreen, + text=white, + ](t){\textbf{timing}}; + \end{tikzpicture} +\end{frame} + +\begin{frame} + \mktitle{Effort to crack this password?} + \begin{tikzpicture}[ + rgddBox/.style = { + draw = black, + minimum width = 20pt, + minimum height = 20pt, + fill = gray!33, + font = \bfseries, + } + ] + \def\rgddBoxData{{z},{f},{T},{B},{s},{v},{g},{O},{e},{t}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i=1\relax + \node[rgddBox](p\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox,right=6pt of p\pgfmathresult](p\i){\x}; + \fi + \node[draw=none,text=darkRed,above=0pt of p\i]{\i}; + } + %\pause + \foreach[count=\i] \x in \rgddBoxData{ + \node[draw=none,text=darkGreen,below=0pt of p\i]{52}; + } + \end{tikzpicture} + \pause + \vfill + 144555105949057024 + \pause + \vfill + $52^{10}$ combinations and 100M queries/s $\rightarrow$ 46 years + %REMINDER@Password: exponential increase for each character + \pause + \\\includegraphics[height=.2\textheight]{img/grandpa} +\end{frame} + +\begin{frame} + \mktitle{Experiment --- are these strings equal?} + \pause + \texttt{0000000000000000} \floatright{\texttt{9389349108837912}}\\ + \pause + \texttt{0000439513027213} \floatright{\texttt{0000431513027213}}\\ + \pause + \texttt{7485820126271479} \floatright{\texttt{7485820126371479}}\\ +\end{frame} + +\begin{frame} + \mktitle{Comparing strings like a programmer} + \begin{tikzpicture}[ + rgddBox/.style = { + draw = black, + minimum width = 20pt, + minimum height = 20pt, + fill = gray!33, + font = \bfseries, + }, + rgddPopup/.style = { + draw=rgdGreen, + thick, + rectangle, + fill=rgdYellow, + minimum width = \textwidth, + minimum height = 40pt, + }, + ] + \def\rgddBoxData{{7},{4},{8},{5}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i=1\relax + \node[rgddBox](p\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox,right=6pt of p\pgfmathresult](p\i){\x}; + \fi + } + + \def\rgddBoxData{{7},{4},{0},{2}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i=1\relax + \node[rgddBox,right=60pt of p4](q\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox,right=6pt of q\pgfmathresult](q\i){\x}; + \fi + } + + \foreach \i in {1,...,3}{ + \only<\i>{\node[draw=none,below=6pt of p\i]{\lding};} + \only<\i>{\node[draw=none,below=6pt of q\i]{\lding};} + } + + \only<4>{ + \node[rgddPopup] at ($ (p4) !.5! (q4) $) {\Huge no need to continue}; + } + \end{tikzpicture} +\end{frame} + +%\begin{frame} +% \mktitle{Programming 101 --- string comparison} +% \lstinputlisting[style=CStyle,firstline=3,lastline=14]{img/strcmp.py} +%\end{frame} + +\begin{frame} + \mktitle{Timing --- an inutitive note} + \includegraphics[width=\textwidth]{img/timeit} +\end{frame} + +\begin{frame} + \mktitle{Effort to crack this password?} + \begin{tikzpicture}[ + rgddBox/.style = { + draw = black, + minimum width = 20pt, + minimum height = 20pt, + fill = gray!33, + font = \bfseries, + } + ] + \def\rgddBoxData{{z},{f},{T},{B},{s},{v},{g},{O},{e},{t}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i=1\relax + \node[rgddBox](p\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox,right=6pt of p\pgfmathresult](p\i){\x}; + \fi + \node[draw=none,text=darkRed,above=0pt of p\i]{\i}; + } + \foreach[count=\i] \x in \rgddBoxData{ + \node[draw=none,text=darkGreen,below=0pt of p\i]{52}; + } + \end{tikzpicture} + \vfill + + \pause + \begin{tikzpicture}[ + rgddBox/.style = { + draw = black, + minimum width = 20pt, + minimum height = 20pt, + fill = gray!33, + font = \bfseries, + } + ] + \def\rgddBoxData{{a},{a},{a},{a},{a},{a},{a},{a},{a},{a}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i=1\relax + \node[rgddBox](q\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox,right=6pt of q\pgfmathresult](q\i){\x}; + \fi + + } + + \def\rgddBoxData{{z},{f},{T},{B},{s},{v},{g},{O},{e},{t}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i<5\pause\fi + \ifnum\i=1\relax + \node[rgddBox, text=darkOrange](q\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox, text=darkOrange, right=6pt of q\pgfmathresult](q\i){\x}; + \fi + } + \end{tikzpicture} + %$52*10$ tries $\rightarrow$ ``negl'' time + %REMINDER@Password: linear increase for each character +\end{frame} + +\begin{frame} + \mktitle{Demo --- Experimental setup} + + \begin{tikzpicture} + \node[draw=none](server){ + \includegraphics[width=60pt]{img/server} + }; + \node[draw=none,left=100pt of server](client){ + \includegraphics[width=40pt]{img/attacker} + }; + \path[draw, -latex] + (client.34) |- + node[draw=none,above,pos=.75]{\texttt{msg, tag}} + (server.155); + \path[draw, -latex] + (server.199) |- + node[draw=none,above,pos=.75]{\texttt{yes/no}} + (client.335); + \path[draw,-latex] + (server) edge[loop right] + node[draw=none,pos=.7,below]{ + \begin{tabular}{c} + byte-by-byte cmp\\ + with $\approx$ms sleep + \end{tabular} + } + (); + + \end{tikzpicture} + \vfill\url{https://github.com/rgdd/timing-server} +\end{frame} + +\begin{frame} + \mktitle{Can you recommend another demo? Asking for a friend} + \includegraphics[height=.67\textheight]{img/demo} + \url{https://www.youtube.com/watch?v=2-zQp26nbY8} +\end{frame} + +\begin{frame} + \mktitle{Countermeasure -- constant time compare} + \begin{tikzpicture}[ + rgddBox/.style = { + draw = black, + minimum width = 20pt, + minimum height = 20pt, + fill = gray!33, + font = \bfseries, + }, + rgddPopup/.style = { + draw=rgdGreen, + thick, + rectangle, + fill=rgdYellow, + minimum width = \textwidth, + minimum height = 40pt, + }, + ] + \def\rgddBoxData{{7},{4},{8},{5}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i=1\relax + \node[rgddBox](p\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox,right=6pt of p\pgfmathresult](p\i){\x}; + \fi + } + + \def\rgddBoxData{{7},{4},{0},{2}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i=1\relax + \node[rgddBox,right=60pt of p4](q\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox,right=6pt of q\pgfmathresult](q\i){\x}; + \fi + } + + \foreach \i in {1,...,4}{ + \only<\i>{\node[draw=none,below=6pt of p\i]{\lding};} + \only<\i>{\node[draw=none,below=6pt of q\i]{\lding};} + } + \end{tikzpicture} +\end{frame} + +%\begin{frame} +% \mktitle{Countermeasure --- constant time compare} +% \lstinputlisting[style=CStyle,firstline=3,lastline=14]{img/countermeasure.py} +%\end{frame} + +\begin{frame} + \mktitle{Lessons learned} + \centering + + \textbf{Adversarial input?} + Think twice before using standard equality operators + + \vfill + \textbf{Cryptography in code?} Stick to cryptographic libraries, hope for + the best +\end{frame} + +\begin{frame} + \mktitle{Meltdown} + \includegraphics[height=.67\textheight]{img/meltdown} + \vfill\scriptsize{ + Lipp \emph{et~al.}: + Meltdown, + In: CoRR abs/1801.01207 + (2018) + } +\end{frame} + +\begin{frame} + \mktitle{Preliminaries --- per-process virtual memory layout} + \includegraphics[width=.67\textwidth]{img/memlayout} + \vfill + \begin{tikzpicture} + \Tree [ + .{page table} [ + .{\textcolor{darkBlue}{address translation}} + ] [ + .{\textcolor{darkGreen}{privelege checks}} + ] + ] + \end{tikzpicture} +\end{frame} + +\begin{frame} + \mktitle{Preliminaries --- caching and out-of-order execution} + \begin{tikzpicture}[ + rgddBox/.style = { + draw = black, + minimum width = 20pt, + minimum height = 20pt, + fill = gray!33, + font = \bfseries, + } + ] + \def\rgddBoxData{{},{},{},{},{},{},{},{},{}} + \foreach[count=\i] \x in \rgddBoxData{ + \ifnum\i=1\relax + \node[rgddBox](p\i){\x}; + \else + \pgfmathparse{int(\i-1)} + \node[rgddBox,right=6pt of p\pgfmathresult](p\i){\x}; + \fi + \node[draw=none,text=darkRed,above=0pt of p\i]{\i}; + + } + + % First access + \node[draw=none,below=of p3,font=\rmfamily](call1){% + \texttt{access}($\mathsf{MEM}[5]$) + }; + \path[draw, -latex] + (call1) -- + node[draw=none,sloped,above,font=\scriptsize]{slow} + (p5.248); + + % Second access + \node[draw=none,below=of p7,font=\rmfamily](call2){% + \texttt{access}($\mathsf{MEM}[5]$) + }; + \path[draw, -latex] + (call2) -- + node[draw=none,sloped,above,font=\scriptsize]{fast} + (p5.292); + \end{tikzpicture} + + \pause + \begin{columns} + \begin{column}{.29\textwidth} + \lstinputlisting[style=CStyle]{img/isn} + \end{column} + + \begin{column}{.49\textwidth} + \includegraphics[width=\textwidth]{img/meltdown-out-of-order} + \end{column} + \end{columns} +\end{frame} + +\begin{frame} + \mktitle{Ooops --- leaked privileged memory?} + \begin{columns} + \begin{column}{.45\textwidth} + \lstinputlisting[style=CStyle]{img/meltdown-isn} + \end{column} + \end{columns} + \pause + \vfill + \includegraphics[width=.67\textwidth]{img/meltdown-pageload} +\end{frame} + +\begin{frame} + \mktitle{Proof of concept} + \hfill + \includegraphics[height=.5\textheight]{img/meltdown-dump} + \hfill + \includegraphics[height=.5\textheight]{img/meltdown-ff} + \hfill +\end{frame} + +\begin{frame} + \vfill\centering\Large\textbf{ + That's it --- questions? + }\vfill +\end{frame} -- cgit v1.2.3