Efficient Cache Attacks on AES, and Countermeasures

By Eran Tromer, Dag Arne Osvik, Adi Shamir. Journal of Cryptology, 2010

541 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Signal Processing

View Paper: https://www.semanticscholar.org/paper/456bcba9a128c52d73347846a75fefd7b4340122

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, unknown): “, access driven attacks [17]) have been demonstrated on x86 architectures, including data caches (and also per-core L2 unified caches) [31], [30], [28], [36], [17], [18], instruction caches [8], [9], [43], and inclusive LLCs [41], [40], [12], [44], [22], [27], [20], [16], [29], [19], [23], [26], [42”
CacheBleed: a timing attack on OpenSSL constant-time RSA (2016, methodology): “[50] note that while scatter–gather has no secret-dependent accesses to cache lines, it does have secret-dependent access to cache banks.”
Flush+Flush: A Fast and Stealthy Cache Attack (2015, methodology): “Access-driven cache attacks are typically devised in two types: Prime+Probe [29, 31,38] and Flush+Reload [11, 44].”
HomeAlone: Co-residency Detection in the Cloud via Side-Channel Analysis (2011, unknown): “, [43], [42], [35], [8], [5], [15], [33], [34], [44], [23], [40], [25], [30], [16], [37], [49], [14], [24], [41].”
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, background): “Similarly, PRIME+ PROBE and EVICT+TIME techniques can also detect the secret key of AES through L1 D-cache, with knowledge of the virtual and physical addresses of AES’s S-boxes [125, 143].”
FLUSH+RELOAD: A High Resolution, Low Noise, L3 Cache Side-Channel Attack (2014, methodology): “Furthermore , as access patterns to data depend on the values of the exponent bits, the code is likely to be vulnerable to PRIME+PROBE attacks [51,61].”
Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems (2015, background): “Cache side-channel attacks [47], [12], [40], [7], [8], [14], [46], [44], [52] are most closely related to the attacks described in this paper, as both exploit”
Last-Level Cache Side-Channel Attacks are Practical (2015, methodology): “This technique has been used for attacks against several processor caches, including the L1 data cache [28, 31, 34, 47], L1 instruction cache [1, 2, 4] and the branch prediction cache [3].”
A Formal Foundation for Secure Remote Execution of Enclaves (2017, background): “cache attacks [68, 74] allow the adversary to learn this information.”
Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu (2017, unknown): “A cache-based side channel can be constructed using data caches (including per-core L2 unified caches) on shared processors [39, 47, 20, 23], instruction caches [5, 58], shared last-level caches (LLC) [55, 59, 33, 18, 40, 25].”
SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution (2018, methodology): “clave. Cache side-channel attacks against enclave programs have been studied recently [7, 19, 21, 60], all of which demonstrated that a program runs outside the enclave may use Prime-Probe techniques [70] to extract secrets from the enclave code, only if the enclave code has secret-dependent memory ”
Backyard Cuckoo Hashing: Constant Worst-Case Operations with a Succinct Representation (2009, methodology): “Research supported by the Adams Fellowship Program of the Israel Academy of Sciences and Humanities.”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, methodology): “…attacks against enclave programs have been studied recently [7, 19, 21, 60], all of which demonstrated that a program runs outside the enclave may use Prime-Probe techniques [70] to extract secrets from the enclave code, only if the en-clave code has secret-dependent memory access patterns.”
STEALTHMEM: System-Level Protection Against Cache-Based Side Channel Attacks in the Cloud (2012, background): “In contrast, Bernstein’s passive timing attack required 227.5 measurements.”
S$A: A Shared Cache Attack That Works across Cores and Defies VM Sandboxing -- and Its Application to AES (2015, background): “A good discussion of that and several other countermeasures like data independent memory accesses and smaller T-tables can be found in [49].”
ARMageddon: Cache Attacks on Mobile Devices (2015, background): “However, full-key recovery is possible with the same techniques by considering more sophisticated attacks targeting different rounds [48, 55], even for asynchronous attackers [23, 27].”
Cross-VM side channels and their use to extract private keys (2012, background): “This strategy has been shown to be successful in single-core, non-virtualized settings [8, 32, 43] by attackers that game OS process scheduling.”
Cross-Tenant Side-Channel Attacks in PaaS Clouds (2014, methodology): “Existing side-channel attacks mountable by one process on another running on the same OS, particularly those that leverage processor caches (e.g., [28, 30, 25, 34, 14, 38]), seem well suited to performing attacks across boundries between ten-ant instances 1 in PaaS deployments.”