# On the Security of Practical Mail User Agents against Cache Side-Channel Attacks +
###### Abstract  
Mail user agent (MUA) programs provide an integrated interface for email services. Many MUAs support email encryption functionality to ensure the confidentiality of emails. In practice, they encrypt the content of an email using email encryption standards such as OpenPGP or S/MIME, mostly implemented using GnuPG. Despite their widespread deployment, there has been insufficient research on their software structure and the security dependencies among the software components of MUA programs. In order to understand the security implications of the structures and analyze any possible vulnerabilities of MUA programs, we investigated a number of MUAs that support email encryption. As a result, we found severe vulnerabilities in a number of MUAs that allow cache side-channel attacks in virtualized desktop environments. Our analysis reveals that the root cause originates from the lack of verification and control over the third-party cryptographic libraries that they adopt. In order to demonstrate this, we implemented a cache side-channel attack on RSA in GnuPG and then conducted an evaluation of the vulnerability of 13 MUAs that support email encryption in Ubuntu 14.04, 16.04 and 18.04. Based on our experiment, we found that 10 of these MUA programs (representing approximately 77% of existing MUA programs) allow the installation of a vulnerable version of GnuPG, even when the latest version of GnuPG, which is secure against most cache side-channel attacks, is in use. In order to substantiate the importance of the vulnerability we discovered, we conducted a FLUSH+RELOAD attack on these MUA programs and demonstrated that the attack restored 92% of the bits of the 2048-bit RSA private key when the recipients read a single encrypted email. c 2020 26 26  
support encrypted email functionality using email encryption standards such as OpenPGP [13] or S/MIME [14]. GnuPG (also known as GPG) [15] is a free implementation of the OpenPGP standard as defined by RFC4880 [13]. Since its introduction in 1997, the GnuPG crypto library has been widely used to implement OpenPGP in many MUA programs; however, though they are widely deployed in practice, there has been little research on the software structure, security dependencies among software components and security implications of MUA programs, especially in terms of cache side-channel attacks. Since [PERSON] et al. [16] first demonstrated the possibility of cache side-channel attacks, many variants have been proposed [17; 18; 19; 20], and most of the secret-dependent cryptographic implementations that are vulnerable to cache side-channel attacks have been identified. For example, the RSA implementation of GnuPG 1.4.13 has a secret-dependent control flow. Thus, by monitoring the execution traces through a cache side-channel, an attacker is able to extract the RSA private key. The discovery of vulnerabilities in GnuPG led to the introduction of a security patch, thus it has been assumed that many of the applications utilizing GnuPG are secure against cache side-channel attacks because the problem was fundamentally resolved within the primitive crypto library; however, surprisingly, we found that many current MUAs are still vulnerable to cache side-channel attacks in cross-virtual machine (VM) environments sharing the same hardware, such as desktop virtualization environments. In order to understand the root cause of this vulnerability, in this study, we conduct an in-depth analysis of the security mechanisms of existing MUA programs and determine how they take advantage of internal and external cryptographic libraries. We then propose a novel MUA attack scenario based on a cache side-channel attack and demonstrate that a number of MUAs are vulnerable to this attack. Our attack leverages the vulnerability of MUAs that allow the installation of an old version of the GnuPG library, which is vulnerable to cache side-channel attacks. An attacker can launch a cache side-channel attack when the victim reads an encrypted email in a VM environment.