Cache Misses and the Recovery of the Full AES 256 Key

Abstract

In recent years, CPU caches have revealed themselves as one of the most powerful sources of information leakage. This information leakage affects any implementation whose memory accesses, to data or instructions, depend on sensitive information such as private keys. In most cases, side-channel cache attacks do not require any specific permission and just need access to a shared cache. This fact, combined with the spread of cloud computing, where the infrastructure is shared between different customers, have made these attacks quite popular. In this paper, we present a novel approach to exploit the information obtained from the CPU cache. First, we introduce a non-access attack that provides a 97\% reduction in the number of encryptions required to obtain a 128-bit AES key. Next, this attack is adapted and extended in what we call the encryption-by-decryption cache attack or EBD, to obtain a 256-bit AES key. When EBD is applied to AES-256, we are able to obtain the 256 bits of the key with less than 10000 encryptions. These results make EBD, to the best of our knowledge, the first practical attack on AES-256 and also demonstrate that AES-256 is only about 3 times more complex to attack than AES-128 via cache attacks. In both cases the target is the AES T-table-based implementation, and we also demonstrate that our approach works in a cross-VM scenario.

Pseudorandom Black Swans: Cache Attacks on CTR_DRBG

“…While the threat of side channels and the availability of AES-NI hardware have resulted in declining usage of T-table AES for encryption and decryption operations, similar lessons do not seem to have been learned for the case of random number generation. Remarkably, even after more than a decade of attacks, [5,13,32,57,64] we show that unprotected and leaky T-tables are still used for encrypting the counter inside CTR_DRBG by the following popular implementations:…”

CACHE SNIPER : Accurate timing control of cache evictions

“…The accesses to the tables are key dependant and not all of them are used during the encryption process. This fact has been exploited multiple times to recover the secret keys [4,9,36].…”

“…The Flush+Reload [69] technique has revealed itself as one of the most reliable sources of information in cache attacks, especially when compared to the Prime+Probe technique [4,9,22,36]. The main reason is that, in the former case, observations are made on a shared memory block, whereas in the latter case, any other process running in the machine could force an eviction and the attacker would not be able to distinguish the origin of the eviction.…”

“…We use the non-access approach described in [9]. In a nutshell, they used information from cache misses, that is whenever the victim did not load the data into the cache.…”

“…Traditionally, cache side channel attacks have focused on cryptographic implementations. For instance, cache attacks have successfully retrieved ECDSA [68], RSA [22,33,70] and AES [4,9,36] keys, even breaking the isolation between virtual machines (VMs) [34,36,56]. As these attacks do not require any special privileges to succeed, side channel attacks pose a great threat and keep gaining attention.…”