Structuring protocol implementations to protect sensitive data

In a bid to limit the harm caused by ubiquitous remotely exploitable software vulnerabilities, the computer sys-tems security community has proposed primitives to al-low execution of application code with reduced privilege. In this paper, we identify and attack the vital and largely unexamined problem of how to structure implementa-tions of cryptographic protocols to protect sensitive data despite exploits. As evidence that this problem is poorly understood, we rst identify two attacks that lead to disclosure of sensitive data in two published state-of-the-art designs for exploit-resistant cryptographic proto-col implementations: privilege-separated OpenSSH, and the HiStar/DStar DIFC-based SSL web server. We then describe how to structure protocol implementations on UNIX- and DIFC-based systems to defend against these two attacks and protect sensitive information from dis-closure. We demonstrate the practicality and generality of this approach by applying it to protect sensitive data in the implementations of both the server and client sides of OpenSSH and of the OpenSSL library.