Lippen: a Lightweight in-Place Pointer Encryption Architecture for Pointer Integrity

Memory-safety vulnerabilities in C and C++ programs continue to enable sophisticated exploitations such as control-flow hijacking and data-oriented attacks. Existing hardware defenses either rely on address space layout randomization or explicit metadata to pointers to verify the integrity. Many mitigation techniques introduce external metadata for security checks, providing strong guarantees, but incur additional memory accesses and memory footprint overhead. In-place protection schemes, such as ARM Pointer Authentication (PAC), achieve low overhead but have limited entropy for security and are susceptible to brute-force attacks. This paper presents Lippen, a hardware-software co-design for full-pointer encryption that provides strong pointer integrity without metadata. Lippen encrypts every pointer with a block cipher, cryptographically binding it to its execution context, and decrypts it transparently at dereference time. By re-purposing the entire 64-bit pointer field for encryption rather than preserving raw address bits, Lippen maximizes entropy, eliminates the brute-force weaknesses of truncated authentication codes, and maintains binary compatibility with existing PAC-enabled software protection. We prototype Lippen on FPGA using 64bit RISC-V Rocket and BOOM cores, and evaluate it with microbenchmarks, nbench, and SPEC CPU2017. We compare against both an in-house PAC implementation on RISC-V and Apple's PAC on the M1 processor. Across these workloads, Lippen provides comprehensive pointer protection with comparable or better runtime overhead to PAC-based schemes, while incurring negligible area and power overhead. These results show that Lippen is a practical design point for deploying strong pointer protection in real processors.