[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 25 Jan 2023 11:34:43 -0800
From: Eric Biggers <ebiggers@...nel.org>
To: oss-security@...ts.openwall.com
Subject: Data operand dependent timing on Intel and Arm CPUs
Hi,
I'd like to draw people's attention to the fact that on recent Intel and Arm
CPUs, by default the execution time of instructions may depend on the data
values operated on. This even includes instructions like additions, XORs, and
AES instructions, that are traditionally assumed to be constant-time with
respect to the data values operated on.
For details, see the documents from each CPU vendor:
Intel: https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/data-operand-independent-timing-isa-guidance.html
Arm: https://developer.arm.com/documentation/ddi0601/2020-12/AArch64-Registers/DIT--Data-Independent-Timing
... as well as the following discussion on the Linux Kernel Mailing List:
https://lore.kernel.org/lkml/YwgCrqutxmX0W72r@gmail.com/T/#u
Non-constant-time instructions break cryptographic code that relies on
constant-time code to prevent timing attacks on cryptographic keys -- i.e., most
cryptographic code. This issue may also have a wider impact on the ability of
operating systems to protect data from unprivileged processes.
For Intel, processors with Ice Lake and later are affected by this issue.
The fix for this issue is to set a CPU flag that restores the old, correct
behavior of data-independent timing: DIT on Arm, and DOITM on Intel.
Linux v6.2 will enable DIT on Arm, but only in the kernel. Without any
additional patches, userspace code will still get data-dependent timing by
default. See https://git.kernel.org/linus/01ab991fc0ee5019
No patch has been merged to enable DOITM on Intel processors. Thus, as-is, it's
not really possible to safely execute cryptographic algorithms on Linux systems
that use an Intel processor with Ice Lake or later. (I'd guess that the same is
true for other operating systems too; Linux is just the one I'm looking at.) To
fix this issue, I've proposed a Linux kernel patch that enables DOITM globally:
https://lore.kernel.org/lkml/20230125012801.362496-1-ebiggers@kernel.org
I consider this issue to be a CPU security vulnerability; it shares many
characteristics with other CPU security vulnerabilities such as Meltdown and
Spectre. However, Intel and Arm do not seem to consider it to be a security
vulnerability. No CVEs seem to have been assigned yet.
- Eric
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
