THE FOLD / CHEAT / THE BACKDOOR / THE DEAD STORE ELIMINATION
THE DEAD STORE ELIMINATION
the wipe that was deleted for being pointless
1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION
You wipe the password buffer before freeing it. Nothing ever reads those zeros, so the writes have no effect on the program’s meaning, so the optimiser deletes them. The secret is still in memory when the page is handed back.
LIT verified live. a 16-byte buffer, filled with a secret, used, cleared, freed. A dead-store pass with no reader after the clear removes 16 of 16 clearing stores and 0 of the secret stores — correctly, since the secret is read and the zeros are not. Replaying only the surviving stores leaves 16 of 16 secret bytes in memory, starting
LIT verified live. a 16-byte buffer, filled with a secret, used, cleared, freed. A dead-store pass with no reader after the clear removes 16 of 16 clearing stores and 0 of the secret stores — correctly, since the secret is read and the zeros are not. Replaying only the surviving stores leaves 16 of 16 secret bytes in memory, starting
65 66 67 68. Put an opaque barrier after the clear — what explicit_bzero is for — and the pass removes 0, leaving 0 secret bytes.2 HOW IT WAS WEAVED · AI + HUMAN
This is the reason
AVAN (AI) wrote the pass rather than describing it, and the first version was wrong in a way worth keeping: given a program whose ‘use’ read only one byte, it deleted fifteen of the sixteen secret stores as well, which is also correct and made the demonstration meaningless. A program that genuinely uses its secret reads all of it — correcting that is what produces 0 secret stores removed and 16 clearing stores removed, which is the actual shape of the bug.
explicit_bzero, memset_s and SecureZeroMemory exist; the same pass has produced real CVEs in TLS and key-handling code.AVAN (AI) wrote the pass rather than describing it, and the first version was wrong in a way worth keeping: given a program whose ‘use’ read only one byte, it deleted fifteen of the sixteen secret stores as well, which is also correct and made the demonstration meaningless. A program that genuinely uses its secret reads all of it — correcting that is what produces 0 secret stores removed and 16 clearing stores removed, which is the actual shape of the bug.
3 ONE DIMENSION
Sixteen writes removed. Sixteen secret bytes left.
4 TWO DIMENSIONS · INTERACTIVE
Run the pass, with and without the barrier.
5 THREE DIMENSIONS + AVAN’S INVERSE
The green forward object.
AVAN’s addition (the inverse-companion): the forward reading is that the optimiser must be stopped from deleting the wipe. The inverse is that ‘dead’ is defined relative to the program, and the attacker is not in the program. The pass asks whether any later instruction reads the value; nothing does, so the store cannot change any output, so it is dead — and every word of that is true. Read backwards, security properties are statements about the machine state, and an optimiser that reasons only about observable behaviour cannot see them, cannot be taught to see them, and will keep deleting them until you say so in a language it does understand.
LIT a 16-byte buffer filled with a secret, used, cleared and freed: a dead-store pass with no reader after the clear removes 16 of 16 clearing stores and 0 of the secret stores - correctly, since the secret is read and the zeros are not - and replaying only the surviving stores leaves 16 of 16 secret bytes in memory starting 65 66 67 68; put an opaque barrier after the clear, which is what explicit_bzero is for, and the pass removes 0, leaving 0 secret bytes
FIG This is the reason explicit_bzero, memset_s and SecureZeroMemory exist; the same pass has produced real CVEs in TLS and key-handling code. AVAN wrote the pass rather than describing it, and the first version was wrong in a way worth keeping: given a program whose 'use' read only ONE byte it deleted fifteen of the sixteen secret stores as well, which is also correct and made the demonstration meaningless. A program that genuinely uses its secret reads all of it, and correcting that produces the actual shape of the bug.
FIG This is the reason explicit_bzero, memset_s and SecureZeroMemory exist; the same pass has produced real CVEs in TLS and key-handling code. AVAN wrote the pass rather than describing it, and the first version was wrong in a way worth keeping: given a program whose 'use' read only ONE byte it deleted fifteen of the sixteen secret stores as well, which is also correct and made the demonstration meaningless. A program that genuinely uses its secret reads all of it, and correcting that produces the actual shape of the bug.
◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE BACKDOOR · David Lee Wise (ROOT0), with AVAN