Secure, Precise, and Fast Floating-Point Operations on X86 Processors
Total Page：16
File Type：pdf, Size：1020Kb
Secure, Precise, and Fast Floating-Point Operations on x86 Processors Ashay Rane, Calvin Lin Mohit Tiwari Department of Computer Science Dept. of Electrical and Computer Engineering The University of Texas at Austin The University of Texas at Austin fashay, ling @cs.utexas.edu [email protected] Abstract Zero Normal Subnormal Infinity NaN 7 11 153 7 7 Floating-point computations introduce several side chan- nels. This paper describes the first solution that closes Table 1: Latency (in cycles) of the SQRTSS instruction for these side channels while preserving the precision of various operands. non-secure executions. Our solution exploits micro- architectural features of the x86 architecture along with novel compilation techniques to provide low overhead. Both x861 and ARM2 provide variable-latency Because of the details of x86 execution, the evaluation floating-point instructions. This variable latency stems of floating-point side channel defenses is quite involved, from the desire to have graceful floating-point arithmetic but we show that our solution is secure, precise, and fast. behavior, which, as we explain in Section 3, requires the Our solution closes more side channels than any prior so- use of so-called subnormal values [8], which are pro- lution. Despite the added security, our solution does not cessed using special algorithms. Since subnormal values compromise on the precision of the floating-point oper- are rare, hardware vendors typically support such values ations. Finally, for a set of microkernels, our solution is in microcode, so as not to slow down the common case. an order of magnitude more efficient than the previous The resulting difference in instruction latency creates a solution. timing side channel, which has been used to infer cross- origin data in browsers and to break differential privacy guarantees of a remote database [3]. 1 Introduction However, variable latency floating-point instructions represent only a part of the problem, since higher level To secure our computer systems, considerable effort has floating-point operations, such as sine and cosine, are been devoted to techniques such as encryption, access typically implemented in software. Thus, the implemen- control, and information flow analysis. Unfortunately, tation of these floating-point operations can leak secret these mechanisms can often be subverted through the use information through other side channels as well. De- of side channels, in which an adversary, with the knowl- pending on the secret values, programs can throw excep- edge of the program, monitors the program’s execution tions, thereby leaking the presence of abnormal inputs to infer secret values. These side channels are signifi- through termination. Programs can also contain condi- cant because they have been used to discover encryption tional branches, which can leak secrets through the in- keys in AES [26], RSA [27], and the Diffie-Hellman key struction pointer, branch predictor, or memory access exchange protocol [14], thereby rendering these sophis- count. Finally, programs that index into lookup tables ticated schemes useless. can leak secrets through the memory address trace. Numerous side channels exist, including instruction To prevent information leaks in both floating-point in- and data caches [27, 26], branch predictors [2], mem- structions and floating-point software, a strong solution ory usage [12, 35], execution time [31, 4], heat [22], should ensure at least four key properties, which cor- power [15], and electromagnetic radiation [9], but one respond to the side channels that we discussed above: particularly insidious side channel arises from the exe- cution of variable-latency floating-point instructions [3, 1http://www.agner.org/optimize/instruction tables.pdf 10], in which an instruction’s latency varies widely de- 2http://infocenter.arm.com/help/index.jsp?topic=/com. pending on its operands, as shown in Table 1. arm.doc.ddi0344k/ch16s07s01.html (1) fixed-time operations that are independent of secret floating-point operations, Escort is 16× faster than values, (2) disabled exceptions, (3) sequential control the previous solution [3]. flow, and (4) uniform data accesses that are independent of the value of secret variables. Previous solutions [3, 5] 5. As an ancillary contribution, we introduce a are inadequate because they do not ensure all four prop- methodology for evaluating the precision and se- erties, are slow, are orders of magnitude less precise, or curity of floating-point operations, which is fraught are difficult to implement. with subtleties. This paper presents a novel solution that closes side The rest of this paper is organized as follows. Sec- channels arising from both hardware and software im- tion 2 describes our threat model, related work, and sys- plementations of floating point operations, providing all tem guarantees. We provide background in Section 3 be- four properties mentioned above. Our compiler-based fore presenting our solution in Section 4. We evaluate solution has two components. our solution in Sections 5–7 . Finally, we conclude in The first component creates building blocks of ele- Section 8. mentary floating-point operations for instructions that are natively supported by the hardware (addition, subtrac- tion, multiplication, division, square root, and type con- 2 Threat Model and Related Work version). Our solution leverages unused SIMD lanes so that fast operations on normal operands are accompanied This section begins by describing our threat model, by slower dummy computations on subnormal operands, which shapes our subsequent discussion of related work yielding a consistent yet low instruction latency for all and of Escort’s security guarantees. types of operands. The second component is a software library of higher- Threat Model. Our goal is to prevent secret floating- level floating-point operations like sine and cosine. point operands from leaking to untrusted principals that The key to creating this second component is a new either read digital signals from the processor’s pins or code transformation that produces fixed-latency func- that are co-resident processes. tions through normalized control flows and data access We assume that the adversary is either an external en- patterns. Code generated by our compiler closes digital tity that monitors observation-based side channels (e.g. side-channels, which have been defined to be those side time [14], memory address trace [11], or the /proc channels that carry information over discrete bits [28]. pseudo-filesystem [12]) or a co-resident process/VM that Whereas previous work in closing digital side channels monitors contention-based side channels (e.g. cache [27] employs a runtime system [28], our solution shifts much or branch predictor state [2]). of the work to compile time, yielding a significantly For off-chip observation-based channels, we assume smaller runtime overhead. that the processor resides in a sealed and tamper-proof This paper makes the following contributions: chip that prevents the adversary from measuring physi- cal side channels like heat, power, electromagnetic radi- 1. We present a novel compiler-based system, called ation, etc. We assume that the CPU encrypts data trans- Escort, for closing digital side channels that arise ferred to and from DRAM. All components other than from the processing of floating-point instructions. the processor are untrusted, and we assume that the ad- versary can observe and tamper with any digital signal. 2. Secure: We demonstrate that our solution is secure For on-chip contention-based channels, we assume that not just against timing but also against digital side the OS is trusted and does not leak the victim process’s channels. We demonstrate Escort’s capabilities by secret information. We also assume that the adversary defeating a machine-learning side-channel attack, cannot observe or change the victim process’s register by defending against a timing attack on the Firefox contents. Our trusted computing base includes the com- web browser, by conducting extensive performance pilation toolchain. measurements on an x86 processor, and by verify- ing our solution’s code using typing rules. Side-Channel Defenses. Decades of prior research 3. Precise: We show that Escort provides precision have produced numerous defenses against side channels, that is identical to that of the standard C math li- the vast majority of which close only a limited number brary. By contrast, the previous solution’s precision of side channels with a single solution. For instance, is off by several million floating-point values. numerous solutions exist that close only the cache side channel [6, 36, 39, 37, 16] or only the address-trace 4. Fast: We show that our solution is fast. On a side channel [33, 20, 32, 29]. Raccoon [28] is the first set of micro-benchmarks that exercise elementary solution that closes a broad class of side channels—in particular, the set of digital side channels—with a sin- does transform loops that leak information through trip gle solution. Similar to Raccoon, Escort also closes counts. Escort is unable to handle programs contain- digital side channels with a single solution, but unlike ing irreducible control flow graphs (CFGs), but standard Raccoon, Escort focuses on closing floating-point digi- compiler transformations [24] can transform irreducible tal side channels, which can arise from variable latency CFGs into reducible CFGs. Escort assumes that the in- floating-point instructions and from software implemen- put program does not use vector instructions, does not tations of floating-point libraries, in which points-to set exhibit undefined behavior, does not terminate abnor- sizes are typically small. Given Escort’s narrower focus mally through exceptions, and is free of race conditions. on floating-point computations, Escort is faster than Rac- Given a program that abides by these limitations, Es- coon by an order of magnitude. cort guarantees that the transformed code produces iden- tical results as the original program, does not leak se- crets through timing or digital side channels, and that the Timing Side-Channel Defenses.