Subject: Re: [Cfrg] how to guard against VM rollbacks

From: "Wei Dai" <[email-masked]>
Date: Sat, 28 Apr 2007 23:13:38 -0700

I have been trying to implement the previously suggested defenses against VM 
rollbacks, and have some additional information about the problem. It 
appears that hashing the current time into an OS-generated random number is 
not sufficient to eliminate the possibility that random numbers will be 
reused. This is because time can also be virtualized, and rolled back along 
with memory. For example, according to [1], VMware virtualizes all hardware 
and software clocks on a virtual machine, except for the CMOS real time 
clock (also known as RTC or time of day or TOD). Unfortunately, the CMOS RTC 
is typically not accessible from a program running with normal privileges. 
And even if the RTC is accessible, its granularity only one second, which 
means random numbers can still be reused if a VM snapshot is cloned and then 
both clones are restarted at nearly the same time.

VMware does provide a way to automatically resynchronize the time of the 
virtual machine after a rollback, by installing a daemon/service on the 
guest operating system. However there doesn't seem to be a reason to suppose 
that after rollback, the daemon/service will be scheduled to run immediately 
by the guest OS, so resynchronization may not occur for some time.

It seems that fixing this problem at the RNG level is not as easy as I 
thought, and requires active cooperation between the RNG and the VM 
software. That may not be feasible in many situations, so there appears to 
be an urgent need for the design and standardization of crypto schemes that 
are tolerant of reuse of random numbers, like the SIV mode of operation [2].

[1] http://www.vmware.com/pdf/vmware_timekeeping.pdf
[2] http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.html 

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg