# On the Security of Practical Mail User Agents against Cache Side-Channel Attacks +
###### Abstract
The attacker is consequently allowed to observe the cache activity of the victim and extract the RSA private key, which can be employed to restore the original content of the victim's email. We evaluate 13 existing MUAs that are available for use with Ubuntu 14.04 LTS, 16.04 LTS and 18.04 LTS. Based on our experiment, we find that 10 of these MUA programs are vulnerable to our attack scenario, even if the secure version of GnuPG is in use. In order to verify the severity of this vulnerability, we delivered a FLUSH+RELOAD attack on the MUA programs and demonstrated that an attack can restore 92% of the bits of the 2048-bit RSA private key when the recipients read a single encrypted email. Because encrypted email uses RSA encryption, the one-time extraction of a private key could compromise the privacy of all future emails. Although cache side-channel attacks have been delivered against various TLS implementation vulnerabilities involving a variety of cryptographic algorithms and protocols, such as Lucky Thirteen [21] and Bleichenbacher [22], few studies have attempted to identify application vulnerabilities. Given that most of the current implementations of cryptographic libraries have been designed or patched to be secure against various cache side-channel attacks, it may be assumed that the applications using them would also be secure. As we demonstrate, however, an application's careless behavior or policies could incapacitate the underlying defense against these attacks. Thus, it is important for applications to avoid total dependency on the underlying defense provided by external security mechanisms; rather, they should carefully design and adopt their own independent security mechanisms. **Contribution. ** Our study makes the following contributions. * We conduct an in-depth analysis of the security mechanisms implemented by existing MUA programs and identify their security flaws in terms of cache side-channel attacks in a virtualized desktop environment. * We propose a novel MUA attack scenario based on a cache side-channel attack. It exploits an implementation flaw in MUA programs that allows a downgrade of the version of the cryptographic library used by the program. We find that many of these MUAs are vulnerable to this attack. * To demonstrate the efficacy of the proposed cache-side channel attack in practice, we investigated the latest version of 13 existing MUA programs that work on Ubuntu 14.04 LTS, 16.04 LTS and 18.04 LTS. We find that 77% of these MUAs are vulnerable to our attack, which can extract 92% of the bits of the 2048-bit RSA private key from MUA users. * We discuss mitigation strategies to secure MUA programs against cache side-channel attacks and explain why the security of the application layer should be independent of the underlying security of the other layers. Though the presented attack scenario utilizes a FLUSH+RELOAD attack to assess the vulnerability, security misconfiguration and implementation flaws of the MUA programs, our scenario is not limited to this attack vector. In other words, more recent cache side-channel attacks such as PRIME+PROBE [18], EVICT+RELOAD [19] and FLUSH+FLUSH [20] can be used as attack vectors to demonstrate the efficacy of the proposed attack on the basis of the system environment involved. **Responsible disclosure**. We have reported our findings to Evolution and disclosed the technical details to Evolution developers. Although we confirmed that the presented attack was possible due to the absence of control over GnuPG, which Evolution relies on, Evolution developers have claimed that it is a complex issue that combines both technical and human factors, which makes it difficult to easily resolve. Some of the technical feedback we obtained from Evolution has been integrated into the paper. **Organization**. The rest of our paper is organized as follows. Preliminaries for MUA programs and cache side-channel attacks are given in Section 2. Our attack scenario, its demonstration on practical MUAs and analysis results are described in Section 3.