A novel cache bank timing attack
A novel cache bank timing attack
复制标题
DOI：
10.1109/iccad.2017.8203771
复制
发表时间：
2017-11
期刊：
影响因子：
--
通讯作者：
Z. Jiang;Yunsi Fei
中科院分区：
文献类型：
--
作者：
Z. Jiang;Yunsi Fei
为了避免执行过程中的信息泄露，现代加密算法的软件实现以恒定的时序复杂度为目标，即指令数不随输入的不同而变化。然而，通常情况下，底层微架构在不同的数据输入下表现不同，这将通过定时通道秘密地泄露机密信息。由于缓存缺失惩罚导致的缓存时间通道破坏了系统的安全性，这是近年来研究的热点问题。在本文中，我们利用细粒度的L1缓存库时间通道，由于缓存库冲突导致的延迟，并开发了一种新的针对基于表查找的加密算法的时间攻击。我们在Sandy Bridge微架构上用三种不同的方法实现了定时攻击，并成功地恢复了完整的128位AES加密密钥。最有效的攻击可以使用75,000个样本达到50%的成功率，使用200,000个样本达到100%的成功率。从采集样本到恢复所有关键字节，整个攻击过程不到3分钟。我们预计新的定时攻击将对各种平台构成威胁，包括基于arm的智能手机和性能关键的加速器，如gpu。
To avoid information leakage through execution, modern software implementations of cryptographic algorithms target constant timing complexity, i.e., the number of instructions does not vary with different inputs. However, often times, the underlying microarchitecture behaves differently under different data inputs, which covertly leaks confidential information through the timing channel. Cache timing channel due to cache miss penalties has been explored in recent years to break system security. In this paper, we exploit a finer-grained L1 cache bank timing channel, the stalling delay due to cache bank conflicts, and develop a new timing attack against table lookup-based cryptographic algorithms. We implement the timing attack with three different methods on Sandy Bridge micro-architecture, and successfully recover the complete 128-bit AES encryption key. The most effective attack can achieve 50% success rate using 75,000 samples and 100% success rate using 200,000 samples. The whole attack process from collecting samples to recoverying all key bytes takes less than 3 minutes. We anticipate the new timing attack to be a threat to various platforms, including ARM-based smart phones and performance-critical accelerators like GPUs.