Karp, Alan H | 23 May 2013 17:00
Picon
Favicon

An admission of guilt

but no promise to do penance.

I've been involved in a discussion with folks about a coming NIST standard on policy expression.  Once piece
of their document explains how they decide whether or not to honor a request, which turns out to be via
ambient authorities.  I pointed out that they've got a confused deputy vulnerability, to which they
responded, "The interpretation given seems correct.  Therefore, this problem might exist." 
Unfortunately, that's all they had to say on the matter.  Oh well, I guess that's progress of a sort.

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-7029
http://www.hpl.hp.com/personal/Alan_Karp
ihab.awad | 23 May 2013 04:29
Picon

Workflowy -- share via secret URL

https://workflowy.com/

Allows users to create a tree of "to-do" items. Each sub-item, at any level of the tree, can be shared by publishing a URL to a read-only or editable (selectable) to the item.

Ihab

--
Ihab A.B. Awad, Palo Alto, CA
_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk
Kenton Varda | 15 May 2013 21:25
Picon
Gravatar

Re: [capnproto] CapNProto and other ocap-relevant technologies.

On Tue, May 14, 2013 at 5:21 PM, Andrew Lutomirski <andy <at> luto.us> wrote:
My suggestion was silly, I think -- it allows you to do crazy things
like computing ill-defined values and forcing them to commit to a
single value.  But you're doing aligned loads of words -- isn't this
exactly what atomic::load(std::memory_order_relaxed) is for?

Oh yeah, I suppose it is.  IIRC atomic::load() is just a load + compiler barrier on x86.  Actually I'm not sure how this is any different from what you suggested, aside from being clearer and more portable.
_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk
Karp, Alan H | 14 May 2013 23:25
Picon
Favicon

FW: [Security Seminar] Thursday (May 16th) Toby Murray

For those of you not on the Stanford distribution list and those of you too busy to read announcements sent on it.

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-7029
http://www.hpl.hp.com/personal/Alan_Karp

> -----Original Message-----
> From: security-seminar-bounces@... [mailto:security-
> seminar-bounces@...] On Behalf Of Ananth Raghunathan
> Sent: Tuesday, May 14, 2013 1:33 PM
> To: security-seminar@...
> Subject: [Security Seminar] Thursday (May 16th) Toby Murray
> 
> Join us this Thursday 4.15 pm in Gates 498 for the next security seminar.
> 
> =================
> 
> How to Prove your Kernel Secure: putting the "s" into seL4 -- provably
> 
> Toby Murray
> 
> Abstract:
> Implementation-level proofs of operating system security have been a
> dream for at least 30 years. We present recent work on verifying
> security properties of the seL4 microkernel, the results of which are
> security theorems that hold for seL4's C code implementation asserting
> that it enforces authority confinement, integrity and information flow
> security (confidentiality). To our knowledge, these are the first such
> security theorems that hold for the implementation of a general-purpose
> kernel.
> 
> We describe how to capture and tame seL4's dynamic capability-based
> access control mechanism in a formal model of access control, which the
> kernel's implementation provably enforces. We then phrase integrity and
> confidentiality with reference to this model and prove them against
> seL4's abstract functional specification. We obtain code level theorems
> by virtue of the earlier functional correctness verification of seL4,
> because our security properties are preserved by refinement. Finally, we
> consider the implications and limitations of these results: "what do
> they mean and how much assurance do they provide?"
> 
> Bio: Toby Murray is a researcher with NICTA, whose interests focus on
> how to apply formal methods and verification to build more secure
> systems. He recently led the successful verification of information flow
> security for the seL4 microkernel, the result of which was the world's
> first proof of confidentiality that applied to the implementation of a
> general-purpose OS kernel. He previously completed a DPhil (PhD) at
> Oxford under the supervision of Gavin Lowe, researching the application
> of the process algebra CSP to reason about the security of
> object-capability patterns, and has also worked for the Australian
> Defence Science and Technology Organisation (DSTO), researching and
> building security architectures for pervasive systems.
> 
> Time and Place:
> Thursday, May 16, 2013, 4.15pm
> Gates 498
> 
> 
> --++**==--++**==--++**==--++**==--++**==--++**==--++**==
> security-seminar mailing list
> security-seminar@...
> https://mailman.stanford.edu/mailman/listinfo/security-seminar
Kenton Varda | 9 May 2013 05:46
Picon
Gravatar

Re: [capnproto] CapNProto and other ocap-relevant technologies.

On Wed, May 8, 2013 at 8:17 PM, Alek Storm <alek.storm <at> gmail.com> wrote:
For the sake of completeness, I'd like to propose a third way to protect a receiver from post-hoc shared memory tampering, as an alternative to wholesale copying or enforcing a read-once constraint. After the sender is finished writing the message to shared memory, the receiver encrypts regions it considers sensitive with, for example, a 128-bit AES cipher*.

That would obviously be much slower that copying (and also requires that the receiver have write access to this memory, which has other complications).
 
Further reads and writes, which may target the same memory locations repeatedly, then incur an extra encryption/decryption step (in blocks of two words). This protects against chosen-plaintext attacks; though the sender may still attempt to crash the receiver by overwriting the sensitive memory regions with garbage data (since it cannot predict how the receiver will decrypt it), the success of this strategy is unlikely, since it relies upon known possible exploits that CnP implementations should already be robust against (infinite pointer recursion, etc).

Imagine a field which stores the size of some buffer.  Initially the attacker sets the size low.  The receiver checks that the size is within some bound, then copies the buffer to a location on the stack.  Except between the validation and the copy, the attacker replaces the size with a random value.  A random integer is likely to be large.  Buffer overrun.  pwned.
 
This approach seems most attractive in situations where memory pressure is already high, or where the data structures that need to be validated are impractical to duplicate, either because they are too large or there are too many simultaneous readers (e.g. in a pub/sub messaging system), each of which would need to make their own copy.

Under your proposal each receiver would need to use the same encryption key while still keeping it secret from the sender.  These receivers would of course be able to interfere with each other.
 
In fact, encryption may be preferable to copying even in CPU-bound programs, as some very rough, but encouraging, benchmarks on my own system show an order-of-magnitude difference in bandwidth between the two strategies (although I'd like to emphasize just how rough and non-representative these benchmarks are).

According to Wikipedia: "On Intel i3/i5/i7 CPUs supporting AES-NI instruction set extensions, throughput can be over 700MiB/s per thread."

Such CPUs have main memory bandwidth on the order of 20-40 GiB/s.
 
* Achieving random access at the block level for both encryption and decryption would require a cipher mode similar to CTR, but rather than encrypting the counter with a certain key and XORing the result with the plaintext to get the ciphertext, the counter is instead XORed with a secret integer, and the result used as the key to encrypt the plaintext. This adjustment is made necessary by the fact that the sender, by knowing the plaintext beforehand, would be able to XOR it with the encrypted data, and then XOR the result with new plaintext of their choosing to generate valid ciphertext. The method described thus derives a non-ECB stream cipher that is nevertheless parallelizable.

Is this an approach that has been studied by cryptographers, or just something you came up with?
_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk
Kenton Varda | 9 May 2013 00:20
Picon
Gravatar

Re: [capnproto] CapNProto and other ocap-relevant technologies.

On Wed, May 8, 2013 at 3:04 PM, Andrew Lutomirski <andy <at> luto.us> wrote:
Sadly "Note that this requires platform-specific runtime support that
does not exist everywhere." (from the gcc docs page)

For this topic, I only care about Linux/x86.  :)  (I certainly wouldn't make the capnproto core library depend on this kind of feature -- it doesn't even require enabling exceptions in the first place.)
_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk
Kenton Varda | 8 May 2013 23:25
Picon
Gravatar

Re: [capnproto] CapNProto and other ocap-relevant technologies.

On Wed, May 8, 2013 at 12:34 PM, Andrew Lutomirski <andy <at> luto.us> wrote:
I think you can with ftruncate.  You can handle that by catching
SIGBUS, but AFAIK nothing other than Windows actually has frame-based
exception handling for things like this.

Fun fact I just discovered:  GCC's -fnon-call-exceptions will in fact allow you to throw a C++ exception from a SIGBUS signal handler (as well as SIGSEGV, SIGFPE, and anything else that the thread brings upon itself by doing something illegal, as opposed to signals sent from other threads/processes).
_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk
Kenton Varda | 8 May 2013 22:04
Picon
Gravatar

Re: [capnproto] CapNProto and other ocap-relevant technologies.

On Wed, May 8, 2013 at 12:34 PM, Andrew Lutomirski <andy <at> luto.us> wrote:
I think you can with ftruncate.  You can handle that by catching
SIGBUS, but AFAIK nothing other than Windows actually has frame-based
exception handling for things like this.

Hmm, yes, it looks like this is indeed an issue.  Thanks.  You could handle it by remapping the memory to something else (say, /dev/zero) in the SIGBUS handler, and then setting a flag to cease handling requests from that sender.

That said, it happens that in my particular use case, the receiving process is serving no other purpose than acting as a communications proxy for the sending process.  If the sender causes the receiver to crash, they have only managed to cut off their access to the world. I'm more concerned with code execution exploits...
 
How careful is careful, though?  For general use, the compiler is free
to determine that capnp accessors are pure functions and, if alias
detection says it's okay, it can translate:

int foo = reader.getFoo();
a = foo;
b = foo;

to:

a = reader.getFoo();
b = reader.getFoo();

So, for safe shared memory usage, some kind of volatile qualifier
might be important.  (gcc, at least, would let you launder values with
a construct like:

int x = (read it);
asm volatile("" : "+rm (x)");
return x;

)

This is a great point.  I could stick a barrier like you suggest into the spot that handles endianness conversion.  I wonder what the performance impact would be in general.  It could be a compile-time option, since only things like my rather-unusual use case would want it.
_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk
Chip Morningstar | 8 May 2013 01:32

Return is not quite introduction

This may fall into the category of stating something obvious that everybody
else but me already knew, but:

I had a thought as I was rereading The Ode To The Granovetter Diagram in the
course of preparing a presentation I'm going to be giving.

In the capability paradigm, the standard list of ways one object can end up
with a reference to another object is typically articulated as 1) by
parenthood, 2) by endowment/construction, and 3) by introduction.  I think
MarkM's thesis also ads 4) by initial conditions. We typically diagram this
stuff using unidirectional message patterns, and so we model the usual
programming language call-return pattern in the continuation passing style,
where the return is explicitly handled as a second message sent to an addressee
who was passed as a parameter in the first message that corresponds to the
call.

Our standard rhetoric about the logic of introduction starts with Alice holding
references to Bob and Carol and passing the Carol reference to Bob in a
message, with the representation that this can only happen if 1) Alice has a
reference to Bob, 2) Alice has a reference to Carol, and 3) Alice chooses to
send the message.

A call-return sequence allows the callee to introduce the caller to somebody,
but the constraints don't quite align with the three rules just articulated, in
that the callee does not (typically) acquire a reference to the caller merely
as a consequence of being called.  Nevertheless, the callee *does* acquire the
means to pass a message to the caller via the return path.  In other words, an
object can send a message to another object without a reference to the
recipient.  Hmmm.

This doesn't really introduce any new semantic wrinkles, in the sense that we
can model call-return in a more complicated way, by passing a reference to a
single-use forwarder object rather than a reference to the caller itself (and
if we were doing this in true continuation passing style we'd need to do
something like this anyway to capture the context at the return point from
which computation is to resume).  Nevertheless, this seems like a lot of
cumbersome mechanism that rather gums up the cleanliness of the explanation.

It makes me wonder if return should be treated as a special case in the
standard explanation, much as we treat connectivity by endowment/construction
as a special case (and I think it *is* such a special case, motivated by a
desire for clarity, since connectivity by construction can be modeled as
parenthood followed by introduction).

Chip
John R. Strohm | 5 May 2013 00:05

Anomaly

For the last few days, I have been receiving double copies of every list post.
 
Anyone have any idea what’s going on?
 
_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk
Kenton Varda | 2 May 2013 09:31
Picon
Gravatar

Re: [capnproto] CapNProto and other ocap-relevant technologies.

On Thu, May 2, 2013 at 12:04 AM, Alek Storm <alek.storm <at> gmail.com> wrote:
On Wed, May 1, 2013 at 8:07 AM, Kenton Varda <temporal-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
On Wed, May 1, 2013 at 7:42 AM, Ben Laurie <benl-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> wrote:
Interesting that you mention this: message passing over shared memory
has been a subject of some discussion in the group I work with at
Cambridge (http://www.cl.cam.ac.uk/research/security/ctsrd/). In
short, its not a great idea when the two ends of the conversation
don't trust each other - this is mostly because its really hard to
write code that behaves well on data that might change between reads.

I have thought about this, but concluded that it is not very hard at all.  One way to be safe is to make sure you read each field at most once, which is what performant code should be striving to do anyway.  If a particular field needs to be validated before use, then you need to make a copy to validate, yes.  But, it is often the case that no further validation is needed beyond what Cap'n Proto does internally.

Promoting a performance optimization to a security requirement seems like too much of a burden on clients (and one that's quite easy to get wrong).

It is absolutely the case that anyone who wants to accept messages via shared memory from an untrusted process needs to be aware of the potential security problems.  But people who know how to do it right should not be prohibited from trying.  In particular, Sandstorm's supervisor process will receive messages from the sandboxed application, and it must be careful to avoid attacks from malicious apps.  There will be only one implementation of the supervisor, and I believe in my own ability to write it correctly.  Individual applications, on the other hand, do *not* need to worry about a malicious supervisor, because a malicious supervisor could just as easily reach directly into their memory and twiddle bits.
 
Copying a composite will certainly ensure a malicious endpoint won't mutate it, but would be costly for large binary blobs. It would be nice if CnP provided a way to optimistically detect tampering by hashing a composite's contents before and after processing, and throwing an error if they compare unequal. To save the receiver the trouble, the sender could write the initial hash itself.

That doesn't work:
1) A malicious sender could temporarily change the data while it is being processed, then change it back before the final hash.
2) Secure hashing is slower than copying, so at that point you might as well just make a copy.
 

Alek

But maybe I've missed something.  Can you give examples of the kind of vulnerabilities you have in mind?

This is why OSes tend to copy syscall arguments before processing them... 

As an example, write(2) needs to validate the buffer pointer and size, so it needs to copy those, but it doesn't need to validate the buffer content, so there's no need to make an upfront copy of it.

With Cap'n Proto, when you call the getter for a pointer, the implementation validates that pointer and effectively returns a copy.

We've been wondering, btw, whether Cap'n Proto would be useful for our
stuff - apparently there's no C/C++ implementation currently?

On the contrary, there is *only* a C++ implementation currently.  :)  (Maybe you were confused by the schema parser / code generator, which is written in Haskell?)

I'd love to chat more about your use case.

--
You received this message because you are subscribed to the Google Groups "Cap'n Proto" group.
To unsubscribe from this group and stop receiving emails from it, send an email to capnproto+unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org.
Visit this group at http://groups.google.com/group/capnproto?hl=en-US.
 
 


_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk

Gmane