High performance CUDA AES implementation: A quantitative performance analysis approach

Abdelrahman, Ahmed A.; Fouad, Mohamed M.; Dahshan, Hisham; Mousa, Ahmed M.

doi:10.1109/sai.2017.8252225

Cited by 26 publications

(9 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To demonstrate the generality of our attack, we port the implementation of AES from a standard and widely used library, the OpenSSL 0.9.7 library, into CUDA code. Note that the ported implementation of AES is similar to the versions evaluated for performance in many other studies [1,30]. We discuss other implementations of AES that are immune to our attack but incur performance degradation in Section 7.…”

Section: Aes Encryptionmentioning

confidence: 99%

“…Since T-tables are constant data and shared by all threads, they are a good candidate to store in the Shared Memory unit. Multiple studies on GPU implementations of AES have demonstrated the advantages of using the Shared Memory unit for storing T-tables [1,3,8,21,30,31,33], and our work adopts this implementation. To assign encryption tasks to GPU threads, we transform the AES encryption procedure into a single GPU kernel, where each GPU thread processes one block encryption, independently.…”

Section: Aes Encryptionmentioning

confidence: 99%

“…To verify our speculation, we slightly modify Microbenchmark 1, as shown in Listing 3, to remove the accumulation instruction after each load instructions, and therefore all the load instructions are independent on each other and can be scheduled in a non-blocking fashion. We run Microbenchmark 2 10,000 times for each stride value in the range of [1,32] and collect the timing information. We calculate the average timing for each stride value and the number of bank conflicts, and obtain a similar linear relationship, shown in Figure 3.…”

Section: Recovering Key Bytesmentioning

confidence: 99%

See 2 more Smart Citations

Exploiting Bank Conflict-based Side-channel Timing Leakage of GPUs

Jiang

Fei

Kaeli

2019

ACM Trans. Archit. Code Optim.

View full text Add to dashboard Cite

To prevent information leakage during program execution, modern software cryptographic implementations target constant-time function, where the number of instructions executed remains the same when program inputs change. However, the underlying microarchitecture behaves differently when processing different data inputs, impacting the execution time of the same instructions. These differences in execution time can covertly leak confidential information through a timing channel. Given the recent reports of covert channels present on commercial microprocessors, a number of microarchitectural features on CPUs have been reexamined from a timing leakage perspective. Unfortunately, a similar microarchitectural evaluation of the potential attack surfaces on GPUs has not been adequately performed. Several prior work has considered a timing channel based on the behavior of a GPU's coalescing unit. In this article, we identify a second finer-grained microarchitectural timing channel, related to the banking structure of the GPU's Shared Memory. By considering the timing channel caused by Shared Memory bank conflicts, we have developed a differential timing attack that can compromise table-based cryptographic algorithms. We implement our timing attack on an Nvidia Kepler K40 GPU and successfully recover the complete 128-bit encryption key of an Advanced Encryption Standard (AES) GPU implementation using 900,000 timing samples. We also evaluate the scalability of our attack method by attacking an implementation of the AES encryption algorithm that fully occupies the compute resources of the GPU. We extend our timing analysis onto other Nvidia architectures: Maxwell, Pascal, Volta, and Turing GPUs. We also discuss countermeasures and experiment with a novel multi-key implementation, evaluating its resistance to our side-channel timing attack and its associated performance overhead. CCS Concepts: • Security and privacy → Hardware security implementation; Side-channel analysis and countermeasures; • Computer systems organization → Single instruction, multiple data;

show abstract

Section: Aes Encryptionmentioning

confidence: 99%

Section: Aes Encryptionmentioning

confidence: 99%

Section: Recovering Key Bytesmentioning

confidence: 99%

See 1 more Smart Citation

Exploiting Bank Conflict-based Side-channel Timing Leakage of GPUs

Jiang

Fei

Kaeli

2019

ACM Trans. Archit. Code Optim.

View full text Add to dashboard Cite

show abstract

“…Abdelrahman et al, [1] propose an implementation of the AES-128 ECB Encryption on three different GPU architectures (Kepler, Maxwell and Pascal). The results show that encryption speeds with 207 Gbps on the NVIDIA GTX TITAN X (Maxwell) and 280 Gbps on the NVIDIA GTX 1080 (Pascal) have been achieved by performing new optimization techniques using 32bytes/thread granularity.…”

Section: Related Workmentioning

confidence: 99%

“…The Electron Code book (ECB) is a mode that assigns a fixed cipher text block to each plaintext block, which can be defined as the equation (1).…”

Section: The Electronic Codebook Modementioning

confidence: 99%

GPU Accelerated AES Algorithm

Wang,

Chu

2019

Preprint

View full text Add to dashboard Cite

It has been widely accepted that Graphics Processing Units (GPUs) is one of promising schemes for encryption acceleration, in particular, the support of complex mathematical calculations such as integer and logical operations makes the implementation easier; however, complexes such as parallel granularity, memory allocation still imposes a burden on real world implementations.In this paper, we propose a benchmarking approach for AES accelerations, including both encryption and decryption. Specifically, we adapt the Electronic Code Book (ECB) mode for cryptographic transformation, Tboxes scheme for fast lookups, and a granularity of 'one state per thread' for thread scheduling. Our benchmarking results offer researchers a good understanding on GPU architectures and software accelerations. In addition, both our source code and experimental results are freely available.

show abstract