python程式執行的資訊洩漏研究與應用

Information Leakage on Python Runtime Execution

藍加良(Lan Jia-Liang)

指導教授 ： 郁方

國立政治大學/商學院/資訊管理學系/碩士(2022年)

https://doi.org/10.6814/NCCU202201682

摘要

當觀察者可以透過旁通道觀察程式在執行中的差異（例如時間、快取和記憶體消耗等）並使用它們來推測機密資料（例如程式的輸入和輸出）時，就會發生資訊洩漏。儘管加密技術使用加密和解密來保護機密資料，但在加、解密執行期間的資訊洩漏可能還是有被推測出機密資料的風險。在這個實驗中，我們在 Python 直譯器中插入可以側錄程式執行相關資訊的程式碼，來實作了一個新的 Python 直譯器，並將側錄執行結果轉換為 JSON 格式，而在這個側錄檔中記錄了程式的執行資訊，包含函式呼叫順序、執行時間、輸入值、回傳值等資訊，我們收集並比較不同輸入集合的執行情況是否存在資訊洩漏，並用來推測出規則從加密資料中恢復機密資料。
我們發現只觀察函式呼叫次數和執行時間的情況下，AES、RSA 和 SHA-1 並沒有發現資訊洩漏，但是可以透過觀察函式的回傳值（int 型別）來推測出輸入長度，而 bytes 型別的回傳值可以得到輸入內容，因此，使用這些 Python 公開的應用程式不僅要保護執行前的輸入和執行後的輸出，也要保護執行過程中內部函式呼叫的回傳值。

關鍵字

資訊洩漏 ； 旁通道攻擊 ； 密碼學 ； AES ； RSA ； SHA-1

並列摘要

Information leakage occurs when an observer can observe differences between executions in the side channel, e.g., time and memory consumption, and uses them to speculate secrets, such as inputs and outputs of the program. Although cryptography techniques protect data using encryption and decryption, information leakage during program execution can be a detrimental side effect.
In this work, we review the leakage of the encryption and decryption of Python programs that are publicly available.
We automatically collect detailed statuses of Python call executions and set the difference in call sets as information leakage to infer rules for restoring secrets (inputs in encryption or outputs in decryption).
Specifically, we first implement a new Python interpreter to insert instrumentation in the synthesized bytecode to dump detailed call execution statuses systematically as our side-channel observation. The profile includes nested call sequences with each call's time consumption and return values.
We collect and compare executions against different inputs to identify potential leakage on call counts, call execution time, and call return values with the aim of recovering (partial) secrets information from the encrypted data.
We report no useful leakage on call count and call execution time against the Python implementation of AES, RSA, and SHA-1. However, we can infer the input length by observing the return value (integer) of a {it bord} function called in the encryption of AES-CBC and SHA-1, and we can obtain the input contents by observing the return value of the {it unpad} function called in decryption of RSA, and SHA-1. Therefore, an application using these Python implementations must protect not only the input and output of the procedure but also the return values of inner calls during the procedure.

並列關鍵字

Side-channel attack ； Information leakage ； Cryptography ； AES ； RSA ； SHA-1

參考文獻

[1] N.Apthorpe,D.Reisman,S.Sundaresan,A.Narayanan,andN.Feamster.Spyingon the smart home: Privacy attacks and defenses on encrypted iot traffic. arXiv preprint arXiv:1708.05044, 2017.

[2] A. Aydin, L. Bang, and T. Bultan. Automata-based model counting for string con- straints. In International Conference on Computer Aided Verification, pages 255– 272. Springer, 2015.

[3] M. Backes, M. Dürmuth, S. Gerling, M. Pinkal, C. Sporleder, et al. Acoustic {Side- Channel} attacks on printers. In 19th USENIX Security Symposium (USENIX Secu- rity 10), 2010.

[4] L.Bang,N.Rosner,andT.Bultan.Onlinesynthesisofadaptiveside-channelattacks based on noisy observations. In 2018 IEEE European Symposium on Security and Privacy (EuroS&P), pages 307–322. IEEE, 2018.

[5] G. Barthe, T. Rezk, and M. Warnier. Preventing timing leaks through transactional branching instructions. Electronic Notes in Theoretical Computer Science, 153(2): 33–55, 2006.