Calibration Done Right: Noiseless Flush+Flush Attacks - ANR - Agence nationale de la recherche Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

Calibration Done Right: Noiseless Flush+Flush Attacks

Résumé

Caches leak information through timing measurements and side-channel attacks. Several attack primitives exist with different requirements and trade-offs. Flush+Flush is a stealthy and fast one that uses the timing of the clflush instruction depending on whether a line is cached. We show that the CPU interconnect plays a bigger role than previously thought in these timings and in Flush+Flush error rate. In this paper, we show that a naive implementation that does not account for the topology of the interconnect yields very high error rates, especially on modern CPUs as the number of cores increases. We therefore reverse-engineer this topology and revisit the calibration phase of Flush+ Flush for different attacker models to determine the correct threshold for clflush hits and misses. We show that our method yields closeto-noiseless side-channel attacks by attacking the AES T-tables implementation of OpenSSL, and by building a covert channel. We obtain a maximal capacity of 5.8 Mbit/s with our method, compared to 1.9 Mbit/s with a naive Flush+Flush implementation on an Intel Core i9-9900 CPU.
Fichier principal
Vignette du fichier
dimva21_didier.pdf (4.25 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03267431 , version 1 (22-06-2021)

Identifiants

  • HAL Id : hal-03267431 , version 1

Citer

Guillaume Didier, Clémentine Maurice. Calibration Done Right: Noiseless Flush+Flush Attacks. DIMVA 2021 - The 18th Conference on Detection of Intrusions and Malware & Vulnerability Assessment, Jul 2021, Lisboa / Virtual, Portugal. ⟨hal-03267431⟩
158 Consultations
366 Téléchargements

Partager

Gmail Facebook X LinkedIn More