Memory tagging allows to establish memory safety for software developed in unsafe languages like C/C++. Since it is an effective mechanism with low architectural complexity, ISA extensions, like ARM MTE or SPARC ADI, already integrate memory tagging on the architectural level for commodity computer systems. However, despite being in high demand, memory tagging features are currently absent in modern x86 processors. This work presents IntegriTag, a hardware-enforced memory tagging solution for existing commodity x86 CPUs. We leverage the Intel® Total Memory Encryption-Multi-Key (Intel® TME-MK) hardware feature that was initially envisioned for virtual machine isolation to instead provide memory tagging capabilities on off-the-shelf x86 processors. Unlike ARM MTE and SPARC ADI, this does not require the integration of a separate tagged memory architecture, which would increase the overall system complexity. Instead, our solution allows us to implicitly enforce the desired security policies by incorporating them into the existing memory encryption integrity checks. In addition, our design addresses security issues that affect tagged memory architectures with small tag spaces. Intel® TME-MK allows for a greater number of key identifier bits, thus offering significantly stronger security compared to the 4-bit tags of ARM MTE and SPARC ADI. We implement a holistic open-source software framework based on Intel® TME-MK, supporting several software-controlled and hardware-enforced memory safety policies. Moreover, we evaluate our design's performance overhead and security properties, underlining the practicability and efficacy of our approach. Our design is binary-compatible with existing software and provides both temporal and spatial memory safety while imposing an overhead of 32–41%, which is significantly lower than the overheads of memory safety schemes in software on commodity hardware that provide comparable security properties.

Capability architectures for memory safety have traditionally required expanding pointers and radically changing microarchitectural structures throughout processors, while only providing superficial hardening. We hence propose Cryptographic Capability Computing (C3) - the first memory safety mechanism that is stateless to avoid requiring extra metadata storage. C3 retains 64-bit pointer sizes providing legacy binary compatibility while imposing minimal touchpoints. Pointers are encrypted to unforgeably (within cryptographic bounds) reference each object. Data is encrypted even in caches and entangled with pointers for both spatial and temporal object-granular protection. Pointers become like unique keys for each allocation. C3 deploys a novel form of prediction for address translation that mitigates performance overheads even when addresses are partially encrypted. Use of a low-latency, low-area cipher from the NIST Lightweight Cryptography project avoids delaying loads by readying a data keystream by the time data is returned from the L1 cache. C3 is compatible with legacy binaries. Simulated performance overhead on SPEC CPU2006 is negligible with no memory overhead, which is a big leap forward compared to the overheads imposed by past memory safety approaches. C3 effectively replaces inefficient metadata with efficient cryptography.

We present the design of a novel low latency, bit length parameterizable cipher, called the "K-Cipher". K-Cipher is particularly useful to applications that need to support ultra low latency encryption at arbitrary ciphertext lengths. We can think of a range of networking, gaming and computing applications that may require encrypting data at unusual block lengths for many different reasons, such as to make space for other unencrypted state values. Furthermore, in modern applications, encryption is typically required to complete inside stringent time frames in order not to affect performance. K-Cipher has been designed to meet these requirements. In the paper we present the K-Cipher design and discuss its rationale. We also present results from our ongoing security analysis which suggest that only 2 to 4 rounds are sufficient to make the cipher operate securely. Finally, we present synthesis results from 2-round 32-bit and 64-bit K-Cipher encrypt datapaths, produced using Intel’s ® 10 nm process technology. Our results show that the encrypt datapaths can complete in no more than 767 psec, or 3 clocks in 3.9-4.9 GHz frequencies, and are associated with a maximum area requirement of 1875 m2.

We present a cryptographic construction called IVP and study its security properties. IVP is a three level confusion-diffusion network that supports confidentiality and data integrity without requiring any message expansion of the content, such as, for example, for the computation of a MAC. We demonstrate that IVP is in the recently proposed class of cryptographic constructions called `Random Oracles according to Observer functions' (RO2). These constructions support a new notion of data integrity called `implicit' data integrity, which is based on the fact that user data usually demonstrate some patterns. If some ciphertext becomes corrupted, then the resulting plaintext no longer demonstrates such patterns. Thus, defense against data corruption attacks becomes possible by hardening the computation of ciphertext values, the plaintext of which demonstrates patterns. The encryption key is considered unknown.We show that IVP supports implicit data integrity and is secure in input perturbing and oracle replacing adversary models. The security of IVP is associated with a pattern which is frequently encountered among client and server data. This is the pattern of encountering 4 or more 16-bit words being equal to each other in a set of 32 words. The cryptographic strength of IVP is 30.215 bits, which is sufficient for defending against on-line data corruption and content replay attacks. Computationally, IVP is much lighter than other authenticated encryption approaches requiring only two additional rounds of AES, beyond the AES standard encryption rounds in the critical path. These correspond to some minimal computation overhead.

We address a well known problem of computer science, the problem of computing the probability that a given number of people m > 1 have the same birthday from among the members of a larger set of cardinality n ≥ m. The solution to this problem for m = 2 is well known and is usually referred to as the ‘birthday surprise probability’. A solution for m = 3 is also known and appears in the 2004 paper by DasGupta [The matching, birthday and the strong birthday problem: a contemporary review, Journal of Statistical Planning and Inference]. Further approximations to the solution of the related problem of computing the minimum number of people to interview until m people with the same birthday are found are presented in the seminal work by Klamkin and Newman [Extensions on the birthday surprise, Journal of Combinatorial Theory, 1967]. In this paper we present a new non-recursive approximation for the birthday probability applicable to any value of m > 1, which yields results that are experimentally proven accurate under the assumption that the number of birthdays is significantly larger than the number of people. Our expression is easy to compute, non-recursive, and applicable to values of m that can be arbitrarily larger than 2 or 3. We verify the validity of our result computing the birthday probability for different values of m, over billions of sets of random values generated using the Intel ® RDRAND hardware random number generation instruction. Our solution is based on a novel tree-based description of the event space which, if used, allows for the computation of the birthday probability efficiently and without involving recursions or multinomial distributions.

Presents a collection of slides that address the topic of computer security. Addresses some of the following topics: attacks that are becoming increasingly sophisticated; malware signatures; major areas of vulnerability; and applications and programs for better network and computer security.

Presents a collection of slides covering the following topics: cyber security; software-only security; hardware support; hardware chip vendors; and hardware security.

In this paper we present system-wide analysis and performance tuning of a SPECweb SSL server. We focus on the banking workload of SPECweb because this workload is 100% SSL-enabled and thus designed to evaluate the SSL web server performance and capacity. In order to gain insight into the unique characteristics of a SPECweb banking server, we conduct extensive experiments and present module and function-level anatomy data. Based on our results, we propose methods for tuning up the server performance, alleviating some of the bottlenecks. One of our main results is that the SPECweb banking workload may not always be a realistic environment for measuring the capacity of an SSL server, due to the fact that it is burdened with overheads which are not related to cryptography and can be removed.

End-to-end communication encryption is considered necessary for protecting the privacy of user data in the Internet. Only a small fraction of all Internet traffic, however, is protected today. The primary reason for this neglect is economic, mainly security protocol speed and cost. In this paper we argue that recent advances in the implementation of cryptographic algorithms can make general purpose processors capable of encrypting packets at line rates. This implies that the Internet can be gradually transformed to an information delivery infrastructure where all traffic is encrypted and authenticated. We justify our claim by presenting technologies that accelerate end-to-end encryption and authentication by a factor of 6 and a high performance TLS 1.2 protocol implementation that takes advantage of these innovations. Our implementation is available in the public domain for experimentation.

In this paper we answer two questions: 1) How can an attacker push the CPU utilization of a state-of-art Internet Key Exchange (IKE) responders to 100% thereby inflecting a Denial of Service (DoS) attack and 2) What are the mitigation mechanisms that can be deployed on IP networks without modifying the protocol? We emulated the DoS attacks in our test lab. We outline our experiments and present the results.

A challenge in secure pairing of two wireless devices is how to share a secret between the two devices in a user-friendly manner, as many users practically choose the simplest setup of no security. Various out-of-band (OOB) methods have been proposed in the literature, where either extra hardware is required (e.g. infrared device, digital camera, near-field communication device, USB flash drive, etc.) or wireless devices with a keyboard/display are assumed. In this paper, we propose a novel method of human perceivable authentication (HPA) that, without any extra hardware, achieves industry-standard security for user interface (UI) constrained devices. A feature of the proposed HPA scheme is the simplicity of user operation for device pairing: a user presses and releases a button on an initiating wireless device in concert with the on/off pattern of LED light on a correspondent wireless device. Simulation experiments have been performed to evaluate the usability aspect of the proposed HPA scheme.