Skip to content

Commit

Permalink
add tests for untrusted tampering with data and metadata
Browse files Browse the repository at this point in the history
This is a test-driven approach to investigating and fixing the issue
mobilecoinfoundation#1576

These tests confirm that the trusted side indeed does not always
detect when untrusted tampers with the memory, at this revision
I have these results:

```
running 5 tests
test helpers::exercise_oram_storage_clear_data ... FAILED
test helpers::exercise_oram_storage_hammer_data ... FAILED
test helpers::exercise_oram_storage_hammer_metadata ... ok
test helpers::exercise_oram_storage_clear_metadata ... FAILED
test helpers::exercise_oram_storage_shims ... ok
```

So the shims work normally when the memory is not tampered with,
and the code detects when the untrusted metadata is hammered.
But it does not detect when it is cleared, or when the data is
tampered with.

This is likely because of the issue point out in mobilecoinfoundation#1576, in the
next commits we will fix it and get all these tests to pass.
  • Loading branch information
cbeck88 committed Mar 8, 2022
1 parent cae8efa commit e990162
Show file tree
Hide file tree
Showing 4 changed files with 816 additions and 13 deletions.
1 change: 1 addition & 0 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions fog/ocall_oram_storage/trusted/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,7 @@ blake2 = { version = "0.9.2", default-features = false, features = ["simd"] }

[target.'cfg(not(any(target_feature = "avx2", target_feature = "avx")))'.dependencies]
blake2 = { version = "0.9.2", default-features = false }

[dev-dependencies]
lazy_static = "1.4"
mc-util-test-helper = { path = "../../../util/test-helper" }
2 changes: 1 addition & 1 deletion fog/ocall_oram_storage/trusted/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ An important optimization is used:
- If the ciphertext metadata from untrusted is all zeroes, then we assume this is
the first time we access the block, and pass all zero metadata and data back
to the Oblivious RAM. Effectively, we lazily zero the data segments in blocks
living untrusted memory memory, and dont require that we write encryptions of
living untrusted memory, and dont require that we write encryptions of
zeros to every memory cell at initialization.

Authentication design
Expand Down
Loading

0 comments on commit e990162

Please sign in to comment.