SSH gets protection against side-channel attacks

Post by loeg » Fri, Jun 21, 2019, 2:45 PM UTC

cesarb wrote: post #74

simias wrote: post #67

Earlier quoted context omitted.

I've tried implementing a couple of (toy) password managers over the years and dealing with private keys is genuinely complicated. Even something as trivial as making sure that the memory gets zeroed correctly when you discard the key is trickier than it seems. Compilers these days are very good at detecting "dummy" memsets to memory that's never read afterwards and optimize them away. You have to use some dirty tric…

> Compilers these days are very good at detecting "dummy" memsets to memory that's never read afterwards and optimize them away. You have to use some dirty tricks to get the compiler to do what you want (copious amounts of volatile helps). Or you can use explicit_bzero(), which is designed for that use case.

Post by zzzcpan » Fri, Jun 21, 2019, 2:52 PM UTC

reza_n wrote: post #72

thijsvandien wrote: post #56

Earlier quoted context omitted.

Could this be implemented at the OS level, i.e. whenever a proces launches, the OS generates a key that it will keep to itself and use to transparently encrypt all memory allocated by that process?

Possibly, but memory is accessed using plain CPU instructions, so it would be hard to transparently encrypt all memory for an application at the kernel level. You do have virtual memory, but I dont think that could be leveraged for this. But who knows whats possible there, maybe if you align and address each memory value at the page boundaries and always force a page fault you could have a really poor implementation…

Post by firethief » Fri, Jun 21, 2019, 2:55 PM UTC

dangerface wrote: post #39

yjftsjthsd-h wrote: post #5

Unfortunate that there's no commentary on performance impact. It's symmetric encryption on a few kB, so probably fast, but I'd like to have numbers.

It's not mentioned because it's irrelevant. There is no security / performance trade off for a secure program. It's secure or its not.

Post by castis » Fri, Jun 21, 2019, 3:01 PM UTC

FDSGSG wrote: post #43

castis wrote: post #37

Earlier quoted context omitted.

"I’m really not convinced". Ok great thanks, neither is anyone else, which is why we'd like numbers.

Why do you think that this specific change would make ssh not "work at all" as opposed to the hundreds of other changes that happen? Do you even pay close attention to those changes? I for sure don't. Why are you concerned about this in the first place? Obviously there's always a general concern about any changes, but what makes this specific change a big deal to you?

Post by pstrateman » Fri, Jun 21, 2019, 3:13 PM UTC

java-man wrote: post #82

sjwright wrote: post #76

Earlier quoted context omitted.

How do you guarantee actual clearing of physical memory in a garbage collected VM?

by explicitly clearing it when an operation is finished. example: https://github.com/andy-goryachev/PasswordSafe/blob/master/s... byte[] key = generateKey(); try { // sensitive operation } finally { Crypto.zero(key); } once the operation finishes, the memory is cleared (and possibly subject to gc) the problem is that some java classes, for instance BigInteger, are not designed for cryptographic operations - it's unde…