Early Detection and Analysis of Leakage Abuse Vulnerabilities
Early Detection and Analysis of Leakage Abuse Vulnerabilities
复制标题
泄漏滥用漏洞的早期检测和分析
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
D. Pouliot
中科院分区：
文献类型：
--
作者：
C. V. Wright;D. Pouliot
为了在真实的世界中发挥作用，有效的密码构造经常会泄露或“泄漏”比人们期望的更多的关于其明文的信息。到目前为止，在提出新的加密构造时解决泄漏的方法完全集中在准确地限定泄漏的信息。不幸的是，没有办法预测这种泄漏对现实世界的影响。在本文中，我们主张赞成一种分析方法，用于量化泄漏的加密结构对攻击，使用泄漏恢复明文或其他敏感信息的脆弱性。与以前的经验和特设的方法来识别和评估这些漏洞相比，分析技术可以在新建筑的设计生命周期中更早地集成，并且分析结果可以更广泛地应用于许多不同类型的数据。我们应用所提出的框架，以评估泄漏配置文件的五个最近的建设确定性和顺序揭示加密。我们的分析发现了针对我们分析的每一个结构的强大攻击，只有一个可能的例外，攻击允许对手恢复几乎任何明文，只有指数小的错误概率。我们希望，这些结果，连同拟议的分析框架，将有助于刺激新的有效的建设与改进的泄漏配置文件，有意义地限制泄漏滥用攻击的权力在真实的世界的发展。
In order to be useful in the real world, efficient cryptographic constructions often reveal, or “leak,” more information about their plaintext than one might desire. Up until now, the approach for addressing leakage when proposing a new cryptographic construction has focused entirely on qualifying exactly what information is leaked. Unfortunately there has been no way to predict what the real-world impact of that leakage will be. In this paper, we argue in favor of an analytical approach for quantifying the vulnerability of leaky cryptographic constructions against attacks that use leakage to recover the plaintext or other sensitive information. In contrast to the previous empirical and ad-hoc approach for identifying and assessing such vulnerabilities, analytical techniques can be integrated much earlier in the design lifecycle of a new construction, and the results of the analysis apply much more broadly across many different kinds of data. We applied the proposed framework to evaluate the leakage profiles of five recent constructions for deterministic and order-revealing encryption. Our analysis discovered powerful attacks against every construction that we analyzed, and with only one possible exception, the attack allows the adversary to recover virtually any plaintext with only an exponentially small probability of error. We hope that these results, together with the proposed analytical framework, will help spur the development of new efficient constructions with improved leakage profiles that meaningfully limit the power of leakage abuse attacks in the real world.