Predicting Secret Keys Via Branch Prediction

By Onur Aciiçmez, Ç. Koç, Jean-Pierre Seifert. The Cryptographer's Track at RSA Conference, 2007

386 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems

View Paper: https://www.semanticscholar.org/paper/2762c266378290594e1715104ef8e98a8cb60d35

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

Citations in the corpus

HomeAlone: Co-residency Detection in the Cloud via Side-Channel Analysis (2011, neutral): “Besides the data cache, other architectural side channels have been exploited in cryptanalysis; as mentioned above, these include the instruction cache [4], the branch target cache [6], [7], and shared functional units [46], [9].”
Jump over ASLR: Attacking branch predictors to bypass ASLR (2016, background): “This assumption is not unrealistic because, as we demonstrate in Section V-A, it is possible for the spy to control the cores on which the victim process is scheduled.”
Translation Leak-aside Buffer: Defeating Cache Side-channel Protections with TLB Attacks (2018, background): “Previously, branch prediction has been attacked to leak data or ASLR information [2, 3, 14, 35].”
Context-Sensitive Fencing: Securing Speculative Execution via Microcode Customization (2019, background): “Microarchitectural attacks leak secret information of a victim process by observing microarchitectural effects of certain performance/power optimizations such as caches, branch speculation, memory disambiguation, and even dynamic voltage and frequency scaling (DVFS), through side-channels such as me”
BranchScope: A New Side-Channel Attack on Directional Branch Predictor (2018, background): “Pseudo-code of the Victim Program (A) and Disassembly of the if-statement (B) int probe_array [2] = {1, 1};//Not-taken”
CacheBleed: a timing attack on OpenSSL constant-time RSA (2016, background): “Persistent-state channels have targeted the L1 data cache [9,17,45,46], the L1 instruction cache [1,5,56], the branch prediction buffer [3,4], the last-level cache [31,33,40,51,54], and DRAM open rows [47].”
Spectre Attacks: Exploiting Speculative Execution (2018, methodology): “other programs. This, in turn, mayresultinunintendedinformationleaksfromoneprogram to another [13]. Past works have demonstrated attacks that leak information through the BTB [26, 11], branch history [7, 6], and caches [29, 30, 35, 21]. In this work we use the Flush+Reload technique [21, 36] and its”
Yet another MicroArchitectural Attack:: exploiting I-Cache (2007, background): “A new group of MA attacks, called Branch Prediction Analysis (BPA), on the other hand, exploit instruction path of a cipher [2, 1, 4, 3].”