{"id":{"repo_id":"vt","oai_identifier":"oai:vtechworks.lib.vt.edu:10919/134208"},"canonical_url":"https://search.dev.ndltd.org/etd/vt/oai:vtechworks.lib.vt.edu:10919/134208","repository":{"repo_id":"vt","name":"Virginia Tech","base_url":"https://vtechworks.lib.vt.edu/oai/request"},"display":{"title":"Brute-force resistant Pointer-Authentication using RISC-V co-processor","abstract":"Pointer authentication is a key hardware mechanism for mitigating memory safety attacks such as return-oriented and jump-oriented programming. In ARMv8.3-A, pointer authentication codes (PACs) are embedded in the upper bits in pointers using tweakable block ciphers like QARMA [1], but these 16-bit PAC space remains susceptible to brute-force attacks, particularly under speculative execution vulnerabilities such as PACMAN [2]. To overcome these limitations, this thesis proposes a pointer encryption scheme wherein the full 64-bit pointer is encrypted using low-latency block ciphers like PRINCEv2 [3]. This design has been realized as a tightly coupled hardware co-processor integrated via the Rocket Custom Coprocessor (RoCC) interface [4], supporting custom RISC-V instructions PTR_SEAL and PTR_UNSEAL for sealing and authenticating pointers at runtime. Benchmark evaluation is performed using SPEC CPU2017 and SPLASH-2, with binaries instrumented through a custom LLVM pass. Experiments are conducted on both a Verilator-based Rocket Chip simulation and a Xilinx VCU118 FPGA implementation. Results indicate that PAC instrumentation incurred a performance overhead of 1.3% to 5.8%, with average slowdowns consistently below 6% across platforms. These findings demonstrate that strong pointer protection can be integrated into RISC-V with minimal performance penalty, confirming the practicality of hardware-enforced pointer authentication.","abstract_html":"Pointer authentication is a key hardware mechanism for mitigating memory safety attacks such as return-oriented and jump-oriented programming. In ARMv8.3-A, pointer authentication codes (PACs) are embedded in the upper bits in pointers using tweakable block ciphers like QARMA [1], but these 16-bit PAC space remains susceptible to brute-force attacks, particularly under speculative execution vulnerabilities such as PACMAN [2]. To overcome these limitations, this thesis proposes a pointer encryption scheme wherein the full 64-bit pointer is encrypted using low-latency block ciphers like PRINCEv2 [3]. This design has been realized as a tightly coupled hardware co-processor integrated via the Rocket Custom Coprocessor (RoCC) interface [4], supporting custom RISC-V instructions PTR_SEAL and PTR_UNSEAL for sealing and authenticating pointers at runtime. Benchmark evaluation is performed using SPEC CPU2017 and SPLASH-2, with binaries instrumented through a custom LLVM pass. Experiments are conducted on both a Verilator-based Rocket Chip simulation and a Xilinx VCU118 FPGA implementation. Results indicate that PAC instrumentation incurred a performance overhead of 1.3% to 5.8%, with average slowdowns consistently below 6% across platforms. These findings demonstrate that strong pointer protection can be integrated into RISC-V with minimal performance penalty, confirming the practicality of hardware-enforced pointer authentication.","abstract_has_math":false,"creators":["Peri, Lalit Prasad"],"institution":"Virginia Tech","degree_name":"Master of Science","degree_level":"masters","degree_discipline":"Computer Engineering","degree_department":"Electrical and Computer Engineering","school":null,"contributors":[],"advisors":[],"committee_chairs":["Xiong, Wenjie"],"committee_members":["Wang, Haining","Hicks, Matthew"],"year":2025,"date_issued":"2025-05-23","date_published":"2025-05-23","updated_at":"2026-07-22T22:20:43Z","subjects":["Pointer Authentication","Memory-Safety","Tweakable Block-Cipher","RISC-V","ISA","Co-Processor"],"languages":["en"],"rights":["In Copyright"],"rights_urls":["http://rightsstatements.org/vocab/InC/1.0/"],"identifier_entries":[{"key":"dc:identifier.other","label":"Dc Identifier Other","values":["vt_gsexam:44011"],"render_values":[{"text":"vt_gsexam:44011","href":null,"code":true}]}]},"links":{"outbound_url":"https://hdl.handle.net/10919/134208","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.committeechair","label":"Committee Chair","values":["Xiong, Wenjie"]},{"key":"dc:contributor.committeemember","label":"Committee Member","values":["Wang, Haining","Hicks, Matthew"]},{"key":"dc:contributor.department","label":"Department","values":["Electrical and Computer Engineering"]},{"key":"dc:creator","label":"Author","values":["Peri, Lalit Prasad"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2025-05-24T08:01:21Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2025-05-24T08:01:21Z"]},{"key":"dc:date.issued","label":"Date","values":["2025-05-23"]},{"key":"dc:publisher","label":"Institution","values":["Virginia Tech"]},{"key":"dc:type","label":"Dc Type","values":["Thesis"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Engineering"]},{"key":"thesis:degree_level","label":"Degree Level","values":["masters"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Master of Science"]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["Virginia Polytechnic Institute and State University"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Pointer Authentication","Memory-Safety","Tweakable Block-Cipher","RISC-V","ISA","Co-Processor"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language.iso","label":"Language (ISO)","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["In Copyright"]},{"key":"dc:rights.uri","label":"Rights URI","values":["http://rightsstatements.org/vocab/InC/1.0/"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.other","label":"Dc Identifier Other","values":["vt_gsexam:44011"]},{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/10919/134208"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["Pointer authentication is a key hardware mechanism for mitigating memory safety attacks such as return-oriented and jump-oriented programming. In ARMv8.3-A, pointer authentication codes (PACs) are embedded in the upper bits in pointers using tweakable block ciphers like QARMA [1], but these 16-bit PAC space remains susceptible to brute-force attacks, particularly under speculative execution vulnerabilities such as PACMAN [2]. To overcome these limitations, this thesis proposes a pointer encryption scheme wherein the full 64-bit pointer is encrypted using low-latency block ciphers like PRINCEv2 [3]. This design has been realized as a tightly coupled hardware co-processor integrated via the Rocket Custom Coprocessor (RoCC) interface [4], supporting custom RISC-V instructions PTR_SEAL and PTR_UNSEAL for sealing and authenticating pointers at runtime. Benchmark evaluation is performed using SPEC CPU2017 and SPLASH-2, with binaries instrumented through a custom LLVM pass. Experiments are conducted on both a Verilator-based Rocket Chip simulation and a Xilinx VCU118 FPGA implementation. Results indicate that PAC instrumentation incurred a performance overhead of 1.3% to 5.8%, with average slowdowns consistently below 6% across platforms. These findings demonstrate that strong pointer protection can be integrated into RISC-V with minimal performance penalty, confirming the practicality of hardware-enforced pointer authentication."]},{"key":"dc:description.abstractgeneral","label":"General Abstract","values":["As cyber-security threats are escalating, and protecting the integrity of software is a growing priority for every industry. A common vulnerability involves attackers hijacking program behavior by tampering with memory addresses, or pointers. Current solutions, like those in commercial ARM processors, offer only partial protection—leaving systems exposed to brute-force attacks. Brute-Force resistant pointer-authentication delivers a stronger defense by encrypting the entire pointer, not just a fragment. Built as a hardware extension to the open-source RISCV processor, this method provides robust security with minimal performance cost. This innovation addresses a critical gap in today's hardware security and is well-positioned for adoption in sectors such as finance, IoT, autonomous systems, and secure cloud infrastructure. With growing demand for trusted computing, said approach offers a scalable path to next-generation secure processors."]},{"key":"dc:description.degree","label":"Dc Description Degree","values":["Master of Science"]},{"key":"dc:format.medium","label":"Dc Format Medium","values":["ETD"]},{"key":"dc:title","label":"Title","values":["Brute-force resistant Pointer-Authentication using RISC-V co-processor"]}]}],"canonical_facts":{"dc:contributor.committeechair":["Xiong, Wenjie"],"dc:contributor.committeemember":["Wang, Haining","Hicks, Matthew"],"dc:contributor.department":["Electrical and Computer Engineering"],"dc:creator":["Peri, Lalit Prasad"],"dc:date.accessioned":["2025-05-24T08:01:21Z"],"dc:date.available":["2025-05-24T08:01:21Z"],"dc:date.issued":["2025-05-23"],"dc:description.abstract":["Pointer authentication is a key hardware mechanism for mitigating memory safety attacks such as return-oriented and jump-oriented programming. In ARMv8.3-A, pointer authentication codes (PACs) are embedded in the upper bits in pointers using tweakable block ciphers like QARMA [1], but these 16-bit PAC space remains susceptible to brute-force attacks, particularly under speculative execution vulnerabilities such as PACMAN [2]. To overcome these limitations, this thesis proposes a pointer encryption scheme wherein the full 64-bit pointer is encrypted using low-latency block ciphers like PRINCEv2 [3]. This design has been realized as a tightly coupled hardware co-processor integrated via the Rocket Custom Coprocessor (RoCC) interface [4], supporting custom RISC-V instructions PTR_SEAL and PTR_UNSEAL for sealing and authenticating pointers at runtime. Benchmark evaluation is performed using SPEC CPU2017 and SPLASH-2, with binaries instrumented through a custom LLVM pass. Experiments are conducted on both a Verilator-based Rocket Chip simulation and a Xilinx VCU118 FPGA implementation. Results indicate that PAC instrumentation incurred a performance overhead of 1.3% to 5.8%, with average slowdowns consistently below 6% across platforms. These findings demonstrate that strong pointer protection can be integrated into RISC-V with minimal performance penalty, confirming the practicality of hardware-enforced pointer authentication."],"dc:description.abstractgeneral":["As cyber-security threats are escalating, and protecting the integrity of software is a growing priority for every industry. A common vulnerability involves attackers hijacking program behavior by tampering with memory addresses, or pointers. Current solutions, like those in commercial ARM processors, offer only partial protection—leaving systems exposed to brute-force attacks. Brute-Force resistant pointer-authentication delivers a stronger defense by encrypting the entire pointer, not just a fragment. Built as a hardware extension to the open-source RISCV processor, this method provides robust security with minimal performance cost. This innovation addresses a critical gap in today's hardware security and is well-positioned for adoption in sectors such as finance, IoT, autonomous systems, and secure cloud infrastructure. With growing demand for trusted computing, said approach offers a scalable path to next-generation secure processors."],"dc:description.degree":["Master of Science"],"dc:format.medium":["ETD"],"dc:identifier.other":["vt_gsexam:44011"],"dc:identifier.uri":["https://hdl.handle.net/10919/134208"],"dc:language.iso":["en"],"dc:publisher":["Virginia Tech"],"dc:rights":["In Copyright"],"dc:rights.uri":["http://rightsstatements.org/vocab/InC/1.0/"],"dc:subject":["Pointer Authentication","Memory-Safety","Tweakable Block-Cipher","RISC-V","ISA","Co-Processor"],"dc:title":["Brute-force resistant Pointer-Authentication using RISC-V co-processor"],"dc:type":["Thesis"],"thesis:degree_discipline":["Computer Engineering"],"thesis:degree_level":["masters"],"thesis:degree_name":["Master of Science"],"thesis:institution_name":["Virginia Polytechnic Institute and State University"]},"updated_at":"2026-07-22T22:20:43Z"}