CoChat
Sign Up
Cited by 21Cryptographic Implementations and SecuritySecurity and Verification in ComputingCryptography and Residue Arithmetic

The DOI matches its Crossref record; 28 of the 28 references it cites were found in a registry or an index.

Pseudo Constant Time Implementations of TLS Are Only Pseudo Secure

Ronen, Eyal, Paterson, Kenneth G., Shamir, Adi·2018·Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
DOI 10.1145/3243734.3243775
Open this paper in CoChat — free account

Abstract

Today, about 10% of TLS connections are still using CBC-mode cipher suites, despite a long history of attacks and the availability of better options (e.g. AES-GCM). In this work, we present three new types of attack against four popular fully patched implementations of TLS (Amazon's s2n, GnuTLS, mbed TLS and wolfSSL) which elected to use "pseudo constant time" countermeasures against the Lucky 13 attack on CBC-mode. Our attacks combine several variants of the PRIME+PROBE cache timing technique with a new extension of the original Lucky 13 attack. They apply in a cross-VM attack setting and are capable of recovering most of the plaintext whilst requiring only a moderate number of TLS connections. Along the way, we uncovered additional serious (but easy to patch) bugs in all four of the TLS implementations that we studied; in three cases, these bugs lead to Lucky 13 style attacks that can be mounted remotely with no access to a shared cache. Our work shows that adopting pseudo constant time countermeasures is not sufficient to attain real security in TLS implementations in CBC mode.

Overview

Integrity signals

Registry

Crossref · 10.1145/3243734.3243775

Cites

28 of 28 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Citations

Cites

Research works printed but not linked: 3

  1. Mehmet Sinan Inci , Berk Gülmezoglu , Gorka Irazoqui , Thomas Eisenbarth , and Berk Sunar . 2016. Cache Attacks Enable Bulk Key Recovery on the Cloud Cryptographic Hardware and Embedded Systems -- CHES 2016 (Lecture Notes in Computer Science), Benedikt Gierlichs and Axel Y . Poschmann (Eds.), Vol. Vol. 9813 . Springer , Heidelberg , 368--388. Mehmet Sinan Inci, Berk Gülmezoglu, Gorka Irazoqui, Thomas Eisenbarth, and Berk Sunar. 2016. Cache Attacks Enable Bulk Key Recovery on the Cloud Cryptographic Hardware and Embedded Systems -- CHES 2016 (Lecture Notes in Computer Science), Benedikt Gierlichs and Axel Y. Poschmann (Eds.), Vol. Vol. 9813. Springer, Heidelberg, 368--388.
  2. Paul Kocher , Jann Horn , Anders Fogh , , Daniel Genkin , Daniel Gruss , Werner Haas , Mike Hamburg , Moritz Lipp , Stefan Mangard , Thomas Prescher , Michael Schwarz , and Yuval Yarom . 2019 . Spectre Attacks: Exploiting Speculative Execution. In 40th IEEE Symposium on Security and Privacy (S&P'19) . Paul Kocher, Jann Horn, Anders Fogh, , Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. 2019. Spectre Attacks: Exploiting Speculative Execution. In 40th IEEE Symposium on Security and Privacy (S&P'19).
  3. Moritz Lipp , Michael Schwarz , Daniel Gruss , Thomas Prescher , Werner Haas , Anders Fogh , Jann Horn , Stefan Mangard , Paul Kocher , Daniel Genkin , Yuval Yarom , and Mike Hamburg . 2018 . Meltdown: Reading Kernel Memory from User Space . In 27th USENIX Security Symposium (USENIX Security 18) . Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. 2018. Meltdown: Reading Kernel Memory from User Space. In 27th USENIX Security Symposium (USENIX Security 18).

Cited by

See all 21

Related

See all

Metadata

Authors
Ronen, E., Paterson, K. G., & Shamir, A.
Affiliations
  • Weizmann Institute of Science (IL)
  • Royal Holloway University of London (GB)
  • Weizmann Institute of Science, Rechovot, Israel
ORCID
Venue
Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
Publisher
ACM
Published
2018-10-15
Volume
2018
Pages
1397-1414
ISSN
1543-7221 (ISSN-L)
DOI
10.1145/3243734.3243775
OpenAlex
W2891653310
Cited by
21
References
28
Citations by year
2025: 2 · 2023: 4 · 2022: 1 · 2021: 2 · 2020: 6 · 2019: 6
FWCI
1.42
Type
conference paper
Language
en
Open access
closed
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
  • ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
  • IACR Cryptology ePrint Archive (submittedVersion)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
  • Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
Keywords
TLS, CBC mode, side-channel attacks, wolfSSL

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review