Fault Attacks on Encrypted General Purpose Compute Platforms

Abstract

Adversaries with physical access to a target platform can perform cold boot or DMA attacks to extract sensitive data from the RAM. In response, several main-memory encryption schemes have been proposed to prevent such attacks. Also hardware vendors have acknowledged the threat and already announced respective hardware extensions. Intel's SGX and AMD's SME will provide means to encrypt parts of the RAM to protect security-relevant assets that reside there.Encrypting the RAM will protect the user's content against passive eavesdropping. However, the level of protection it provides in scenarios that involve an adversary who is not only able to read from RAM but can also change content in RAM is less clear. Obviously, encryption offers some protection against such an "active" adversary: from the ciphertext the adversary cannot see what value is changed in the plaintext, nor predict the system behaviour based on the changes. But is this enough to prevent an active adversary from performing malicious tasks?This paper addresses the open research question whether encryption alone is a dependable protection mechanism in practice when considering an active adversary. To this end, we first build a software based memory encryption solution on a desktop system which mimics AMD's SME. Subsequently, we demonstrate a proof-of-concept fault attack on this system, by which we are able to extract the private RSA key of a GnuPG user. Our work suggests that transparent memory encryption is not enough to prevent active attacks.

SEVered

“…Additionally, in contrast to our prototype, both [9] and [5] did not realize the attack on real hardware, as only the AMD specifications for SEV and SME were public. The results of our work strongly indicate that [9] also works on real SEV platforms.…”

“…Buhren et al [5] leveraged fault attacks on Secure Memory Encryption (SME) platforms, which SEV is built upon. They showed that it is possible to extract the private RSA key of a GnuPG user from encrypted memory.…”

SEVurity: No Security Without Integrity : Breaking Integrity-Free Memory Encryption with Minimal Assumptions

“…Using a modified firmware, they are able to extract the private key, used by the SP to authenticate itself as an AMD device. Data Faults In [11], Buhren et al explore the idea of performing classical fault attacks on application data in memory. They flip a bit in a ciphertext block, in order to create garbled plaintext.…”

CROSSLINE: Breaking "Security-by-Crash" based Memory Isolation in AMD SEV

“…With an encryption oracle, the adversary could breach the integrity of the victim VM and force the victim VM to (1) execute arbitrary instruction, or (2) alter sensitive data, or (3) change control flows. Note that our encryption oracle differs from those in the prior works [8], [6], [17] as it does not rely on SEV's memory integrity flaws.…”