LIPPEN: A Lightweight In-Place Pointer Encryption Architecture for Pointer Integrity
2026-05-05 • Cryptography and Security
Cryptography and SecurityHardware Architecture
AI summaryⓘ
The authors address the problem of memory-safety issues in C and C++ programs that allow hackers to exploit software by manipulating pointers. They introduce LIPPEN, a method that encrypts every pointer fully to ensure its security without adding extra metadata. LIPPEN encrypts pointers based on their current use, making attacks much harder, and works efficiently on standard hardware. Their tests show that LIPPEN is as fast as existing pointer authentication methods but offers stronger protection without increasing power or space usage. This makes LIPPEN a practical way to improve software security at the processor level.
memory safetypointer encryptionpointer authentication code (PAC)hardware-software co-designaddress space layout randomization (ASLR)RISC-Vcontrol-flow hijackingFPGASPEC CPU2017binary compatibility
Authors
Erfan Iravani, Lalit Prasad Peri, Mohannad Ismail, Charitha Tumkur Siddalingaradhya, Changwoo Min, Elif Bilge Kavun, Wenjie Xiong
Abstract
Memory-safety violations in C and C++ programs continue to enable sophisticated exploitation techniques such as control-flow hijacking and data-oriented attacks. Existing hardware defenses either rely on address space layout randomization (ASLR) or attach explicit metadata to pointers to verify their integrity. External metadata schemes provide strong guarantees, but incur additional memory accesses and memory footprint overhead. In-place authentication mechanisms, such as ARM Pointer Authentication (PAC), achieve low overhead at the cost of limited entropy and susceptibility to brute-force and reuse attacks. This paper presents LIPPEN, a hardware-software co-design for full-pointer encryption that provides strong pointer integrity and confidentiality with zero metadata overhead. LIPPEN treats every pointer as an encrypted block, cryptographically binding it to its execution context and decrypting it transparently at dereference time. By re-purposing the entire 64-bit pointer field for encryption rather than preserving raw address bits, LIPPEN maximizes entropy, eliminates the brute-force weaknesses of truncated authentication codes, and maintains binary compatibility with existing PAC-enabled software. We prototype LIPPEN on FPGA using 64-bit RISC-V Rocket and BOOM cores, and evaluate it with microbenchmarks, nbench, and SPEC CPU2017. We compare against both an in-house RISC-V PAC implementation and Apple's PAC on the M1 processor. Across these workloads, LIPPEN provides comprehensive pointer protection with runtime overhead comparable to PAC-based schemes, while incurring negligible area and power overhead. These results show that LIPPEN is a practical design point for deploying strong pointer protection in real processors.