Sciweavers

DSN
2007
IEEE

Protecting Cryptographic Keys from Memory Disclosure Attacks

13 years 10 months ago
Protecting Cryptographic Keys from Memory Disclosure Attacks
Cryptography has become an indispensable mechanism for securing systems, communications and applications. While offering strong protection, cryptography makes the assumption that cryptographic keys are kept absolutely secret. In general this assumption is very difficult to guarantee in real life because computers may be compromised relatively easily. In this paper we investigate a class of attacks, which exploit memory disclosure vulnerabilities to expose cryptographic keys. We demonstrate that the threat is real by formulating an attack that exposed the private key of an OpenSSH server within 1 minute, and exposed the private key of an Apache HTTP server within 5 minutes. We propose a set of techniques to address such attacks. Experimental results show that our techniques are efficient (i.e., imposing no performance penalty) and effective — unless a large portion of allocated memory is disclosed.
Keith Harrison, Shouhuai Xu
Added 02 Jun 2010
Updated 02 Jun 2010
Type Conference
Year 2007
Where DSN
Authors Keith Harrison, Shouhuai Xu
Comments (0)