Building Provably Secure Systems - CMU Engineering · Building Provably Secure Systems Bryan Parno...

transcript

Building Provably Secure Systems

Bryan Parno

Associate Professor, CSD & ECE

The Ironclad Project

Ironclad Apps

Hardware specs

MathTPM DriverNet Driver

UDP/IP Datatypes RSA

Ethernet BigNumSHA-256

Std. Lib Common

Latelaunch

IOMMUSegs GCDevice

[OSDI 2014]

Full Verification of Complex Systems

Ironclad Apps

Hardware specs

Std. Lib Common

Latelaunch

IOMMUSegs GCDevice

[OSDI 2014]

IronFleet[SOSP 2015]

Crypto Algorithms

RSA SHA

Network buffers

Everest HTTPSIronclad Apps

Hardware specs

Std. Lib Common

Latelaunch

IOMMUSegs GCDevice

[OSDI 2014]

IronFleet[SOSP 2015]

Ironclad Apps

Hardware specs

Std. Lib Common

Latelaunch

IOMMUSegs GCDevice

[OSDI 2014]

Ironclad Apps: End-to-End Security via Automated Full-System Verification

[OSDI 2014]

Online and Mobile Security

• Chase Online, the Chase Mobile app and the Chase Mobile website use Secure Socket Layer (SSL) technology

…• We periodically review our operations and

business practices to make sure they comply with the corporate policies and procedures we follow to protect confidential information

[OSDI 2014]

An Ironclad app guarantees to remote parties that every instruction it executes adheres to

a high-level security spec.

My password will never leak

My personal data will not be misused

Our formal, end-to-end guarantee

• End-to-end secure communication with provably secure assembly code

• Implies:

– No buffer overflows

– No code injection

– No type-safety flaws

– No information disclosures

– No crypto impl flaws

Std. Lib Common

Latelaunch

IOMMUSegs GCDevice

• Implies:

Std. Lib Common

Latelaunch

IOMMUSegs GCDevice

• Implies:

Std. Lib Common

Latelaunch

IOMMUSegs GCDevice

1st Version: Secure, but non-functional

Ironclad Apps

Password Protector

password12345612345678abc123monkeyqwerty

letmeindragon111111baseballiloveyoutrustno1

Ironclad Apps

Password Protector Notary

Ironclad Apps

Trusted Incrementer

0373 0027

1288 9823

Ironclad Apps

Insert datum

Database

Privacy budget

Key pair

Trusted Incrementer Differentially Private DB

0373 0027

1288 9823

Crypto Algorithms

RSA SHA

Network buffers

Everest HTTPS

The HTTPS Ecosystem is critical

• Most widely deployed security protocol?

– 40% all Internet traffic (+40%/year)

• Web, cloud, IoT, email, VoIP, 802.1x, VPNs, …

Services & Applications

ServersClients

cURL WebKit IIS ApacheSkype NginxEdge

HTTPS Ecosystem

The HTTPS Ecosystem is complex

RSA SHA

Network buffers

Untrusted network (TCP, UDP, …)

Crypto Algorithms

ServersClients

Certification Authority

The HTTPS Ecosystem is buggy• 20 years of attacks & fixes

Buffer overflowsMemory managementIncorrect state machinesLax certificate parsingWeakly or badly implemented cryptoSide channelsError-inducing APIsFlawed standards…

• Many implementationsOpenSSL, Schannel, NSS, …

Still patched every month!

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

The HTTPS Ecosystem is buggy• 20 years of attacks & fixes

Buffer overflowsMemory managementIncorrect state machinesLax certificate parsingWeakly or badly implemented cryptoSide channelsError-inducing APIsFlawed standards…

• Many implementationsOpenSSL, Schannel, NSS, …

Still patched every month!

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

Everest:

Deploying Verified-Secure Implementations in the HTTPS Ecosystem

Everest Goals

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

Everest Goals• Fully verified replacement

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

• Widespread deployment

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

$ apt-get install verified_https

$ /etc/init.d/apache2 restart

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

$ apt-get install verified_https

$ /etc/init.d/apache2 restart

• Trustworthy, usable tools

RSA SHA

Network buffers

Crypto Algorithms

ASN.1Certification

Authority

ServersClients

Research Questions

• How do we decide whether new protocols are secure?– Especially when interoperating with insecure protocols

• Can we make verified systems as fast as unverified?

• How do we handle advanced threats?– Ex: Side channels

• Why should we trust automated verification tools?

• How can verification be more accessible?– Especially to non-experts in verification

Verified Crypto

RSA SHA

Network buffers

Crypto Algorithms

Why verify crypto?

• Bugs are real, and potentially devastating!

Why verify crypto?

• 3 bugs in OpenSSL’s Poly1305 this year!

Why verify crypto?

• 3 bugs in OpenSSL’s Poly1305 this year!

“These produce wrong results. The first example does so only on 32 bit,

the other three also on 64 bit.”

“I believe this affects both the SSE2 and AVX2 code. It does seem to be

dependent on this input pattern.”

“I'm probably going to write something to generate random inputs and stress

all your other poly1305 code paths against a reference implementation.”

• Hand-written mix of Perl and assembly

• Customized for 50+ hardware platforms

Current State of the Art: OpenSSL

• Why?• Performance!

Vale: extensible, automated assembly language verification

machine model (Dafny/F*/Lean)

type reg = r0 | r1 | ...type ins =

Mov(dst:reg, src:reg)| Add(dst:reg, src:reg)| Neg(dst:reg)…

instructions

eval(Mov(dst, src), …) = …eval(Add(dst, src), …) = …eval(Neg(dst), …) = ……

semantics

print(Mov(dst, src), …) =“mov “ + (…dst) + (…src)

print(Add(dst, src), …) = ……

code generation

Vale code

procedure mov(…)requires …ensures …

{ … }

procedure add(…)…

machine interface

procedure quadruple(…)requires 0 <= r0 < 230;ensures r1 == r0 * 4;

{mov(r1, r0);add(r1, r0);add(r1, r1);

program[Mov(r1, r0),Add(r1, r0),Add(r1, r1)]

lemma_mov(…);lemma_add(…);lemma_add(…);

code proof

TrustedComputingBase

mem[eax] == SHA(mem[ebx])

crypto spec

Crypto implementations

HACL*: High-Assurance Crypto Library

• ChaCha20: Stream cipher

• Poly1305: MAC

• Curve 25519: Elliptic curve

• Verified, side-channel resistant BigIntegers

• Cryptographic construction: AEAD

– Demonstrates concrete securitydefinitions and crypto proofs

Vale crypto

• SHA-256 on ARM

– Demonstrates flexibility necessary to match OpenSSL’s performance

– Uncovered leakage in OpenSSL

• SHA-256 on x86 and x64

– Demonstrates platform agnosticism

– Demonstrates spec and proof reuse

• AES-CBC on x86

– Demonstrates advanced HW features

• Poly1305 on x64

– Demonstrates mathematical specs

Crypto implementations

HACL*: High-Assurance Crypto Library

• ChaCha20: Stream cipher

• Poly1305: MAC

• Curve 25519: Elliptic curve

• Verified, side-channel resistant BigIntegers

• Cryptographic construction: AEAD

– Demonstrates concrete securitydefinitions and crypto proofs

Vale crypto

• SHA-256 on ARM

– Demonstrates flexibility necessary to match OpenSSL’s performance

– Uncovered leakage in OpenSSL

• SHA-256 on x86 and x64

– Demonstrates platform agnosticism

– Demonstrates spec and proof reuse

• AES-CBC on x86

– Demonstrates advanced HW features

• Poly1305 on x64

– Demonstrates mathematical specs

Caveat: Can’t verify crypto assumptions!

Vale Performance

• At parity with OpenSSL!

• Caveats

– Specific platforms

– Missing OpenSSL’s advanced modes

Summary

Summary• Ironclad Apps guarantee end-to-end security to remote

parties: Every instruction meets the app’s security spec

• IronFleet extends these techniques to prove the safety and liveness of distributed systems

• Everest will showcase the power of verification and its applicability to real-world security problems

• Verification of systems code is possible, and we’re scaling it to even larger more complex systems

https://github.com/Microsoft/Ironclad

Thank you!parno@cmu.edu

Building Provably Secure Systems - CMU Engineering · Building Provably Secure Systems Bryan Parno...

Documents