Historical Overview of Side Channel Attacks

Question 1

Overview of SC history

Answer 1

Prime+Probe => FLUSH/RELOAD => Speculation assisted

Question 2

Prime+Probe

Answer 2

○ Secret exponent split into small groups of bits, called windows
○ For each window, use window to index into a table of partial results, then combine result into overall result
○ Entries in partial results table are very large => occupy multiple cache blocks
○ Attacker fills cache with its own data (Prime), RSA evicts the data, attacker requests same data again (probe)
==> can recover entire secret key from exponent

Question 3

3 mitigations for cache-based SC

Answer 3

1. Cache partitioning - each process has its own line in the set and cannot access other processes’ lines
2. Prevent high-accuracy measurement of time - cache hit vs miss is measured in 100s of nanoseconds => don’t allow processes to get elapsed time in ns
3. Make sequence of block accesses not dependent on secret data (preferred, no processor support needed)

Question 4

FLUSH/Reload

Answer 4

○ Attack on modular exponentiation
§ If (bit == 1) then: X
§ (Do nothing if bit is 0)
○ Attacker program loads crypto library into memory
○ System libs are loaded into memory once (to save space)
○ Attacker program uses clflush instruction to flush the instruction X out of the cache block
○ ==> Presence / absence of a that block in the cache tells us if the last bit was a 0 or a 1
Attacker can just read instruction X, and measure how long it took (slow? Block not in the cache, bit is 0, fast? Block is in the cache, bit is 1)

Question 5

Mitigation for FLUSH+RELOAD

Answer 5

secret-independent control flow

Question 6

Spectre (variant 2)

Answer 6

§ Used Prime-and-Probe-like shared cache SC
§ Victim RSA with scatter-gather
§ Train branch-predictor so that it loads from memory based on a wval-based address
§ Use Prime and Probe to recover

Question 7

how to train branch predictor in spectre variant 2

Answer 7

• If secret is stored in R1, make victim program speculatively start executing at an address that uses R1 to access memory
• Can then use a cache SC to tell which memory was accessed ==> can figure out what value was in R1 ==> now know the secret