An Analytical Model for Tim e-Driven Cache Attacks Kris Tiri Onur - - PowerPoint PPT Presentation
An Analytical Model for Tim e-Driven Cache Attacks Kris Tiri Onur Ac imez Michael Neve Flemming Andersen Outline Motivation Cache attacks: origins, time-driven attack Strength of an implementation Analytical model of
Kris Tiri Onur Acıiçmez Michael Neve Flemming Andersen
2
FSE 2007
Motivation Cache attacks: origins, time-driven attack Strength of an implementation Analytical model of time-driven attack Experimental results Conclusions
3
FSE 2007
Information leakage from implementation
– Example: safecracker “feels” tumblers impacting – Covert channel without conspiracy or consent
Cache Side-Channel Attacks
– 1996: presumed possible [Kocher] – 2002: theoretical work [Page] – 2003: first practical results on DES [Tsunoo] – 2005: first practical results on AES, RSA [Bernstein][Osvik][Percival]
4
FSE 2007
Attack depends on crypto implementation and on cache architecture Experimental results cumbersome to obtain Can we put a stake in the ground on strength of any implementation
running on any microprocessor w.r.t. a time-driven cache attack?
5
FSE 2007
Information leaks resulting from the implementation of the cache Difference between cache hit & cache miss is observable/ measurable
MEMORY
CACHE CPU
6
FSE 2007
Cache is shared between processes Cache state persists despite context switch Data is protected, metadata is unprotected Cache access pattern depends on cache state and processed data Spy-process can observe key-dependent cache accesses of crypto-process Observation techniques: time-driven attack, trace-driven attack, access-driven attack
7
FSE 2007
Leakage: number of cache misses depend on data
0 1 0 0 0 0 0 0 1 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 if (P0==Pj) E = 0; else E = 1;
estimations device key fragment guess unknown secret key input model analysis measurements
8
FSE 2007
location Te4 in cache 9 cache misses 7 cache misses
OpenSSL: 5 tables (Te0..4) of 1024 bytes
– 16 accesses to table Te4 in last round
empty cache
device: execution time ~ all cache misses model: if (collision) estimation = 0; else estimation = 1; cache line estimation
< sbox-1(RK0
(10)⊕C0)> = = < sbox-1(RKi (10)⊕Ci)>
table index estimation
C0= = RK0i
(10)⊕Ci with RK0i (10)= RK0 (10)⊕RKi (10)
plaintext A plaintext B
9
FSE 2007
How many measurements are required?
[Mangard2005] Quantile of standard normal distribution for probability α How sure do you want to be? Correlation coefficient between estimations and measurements How accurate is your model?
and modeled measurements
1 0
FSE 2007
Assumptions:
to number of cache misses
1 1
FSE 2007
2 2 2 2
) ( ) ( ) ( ) ( ) ( ). ( ) . ( M E M E E E E E M E E E M E E
secret secret secret secret
K K K K
− − − = ρ
2 2 2 2
) ( ) ( ) ( ) ( ) ( ). ( ) . ( M E M E E E E E M E E E M E E
secret secret secret secret
K K K K
− − − = ρ
time ~ cache misses: independent accesses to T tables:
measurement model with k accesses to l lines:
=
=
T t t
M E M E
1
) ( ) (
l k j P j l k
M l j l k M
, ) ( . ,
2 1 , 2 2
μ σ − =∑
=
=
=
l j l k M
j P j l k
1 ,
) ( . , μ ) , ( ) , (
misses time
M E M E ρ ρ =
1 2
FSE 2007
2 2 2 2
) ( ) ( ) ( ) ( ) ( ). ( ) . ( M E M E E E E E M E E E M E E
secret secret secret secret
K K K K
− − − = ρ
let’s estimate cache hits to ease
TIE CLE
2 2 2 2
) ( ) ( ) ( ) ( ) ( ). ( ) . ( M E M E E E E E M E E E M E E
secret secret secret secret
K K K K
− − − = ρ
independent accesses correct prediction
) , ( ) , ( M E M E
hits miss
ρ ρ = ) ( . ) 1 ( . 1 ) ( = + = = E P E P E E
T
l 1
T
r 1 ( ) ( ) l k l k
M H
, 1 , − = μ μ
− =
+ =
1 1
) ( ). ( ) . ( ) . (
T t t K T K K
M E E E M E E M E E
secret secret secret
1 3
FSE 2007
analytical model for time-driven cache attacks
=
T t t t M T T D E E
1 2 2 2 2 2
α
probability α to find key kt accesses to table t consisting of rt elements
T tables in cipher operation table T is table of interest
1 4
FSE 2007
cache line estimation 99% success 16 accesses to table of interest Te4 of 16 lines 36 accesses to 4 tables Te0..3 each of 16 lines measured: 10000 cache line estimation 99% success 16 accesses to table of interest Te4 of 16 lines 36 accesses to 4 tables Te0..3 each of 16 lines
=
T t t t M T T D E E
1 2 2 2 2 2
α
2 2 2 2 2
M M D
2 2
1 1 1
T T T
l l l −
1 5
FSE 2007
setup:
single process perf-counters
experiments:
round
1 6
FSE 2007
Cache line estimation is lT/ rT times more effective than table index estimation Yet 216 key search space instead of 28
e.g. 64 byte cache line: timeTIE = 16.N.28.Δtime timeCLE = N.216.Δtime T T TIE E E CLE E E CLE TIE
2 2 2 2
1 7
FSE 2007
Metric is based on signal-to-noise ratio
√ΣσM
2
μD cache misses cache miss distribution
with cache collision in table of interest f(X)/σ cache miss distribution
T-1
ΣμM+μH
T
ΣμM
( ) ( ) ( ) ( )
B A T t t t M T T D T t t t M T T D A B
SNR SNR l k l k l k l k N N
B B B B B B A A A A A A
= =
= = 1 2 2 1 2 2
, , , , σ μ σ μ
1 8
FSE 2007
Analytical model forecasts resistance of block cipher implementations against time-driven cache attacks using:
Model accuracy verified with measurement results for different implementations, attack scenarios and platforms
1 9
FSE 2007