Leveraging Hardware Transactional Memory for Cache Side-Channel Defenses

Chen, Sanchuan; Liu, Fangfei; Mi, Zeyu; Zhang, Yinqian; Lee, Ruby B.; Chen, Haibo

doi:10.1145/3196494.3196501

Cited by 24 publications

(12 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although there have been a large number of countermeasures proposed to prevent timing attacks on CPUs [2,4,9,17,18,20,23,24,34,38,41], none of them can defend against our attack, because our attack exploits a very different timing channel than the common cache timing channel [11,25,37,39]. More recently, RCoal [15] was proposed to defeat the timing attack using the memory coalescing unit on a GPU [13], but the countermeasure addresses the timing leakage only in the memory coalescing unit.…”

Section: Discussion and Countermeasuresmentioning

confidence: 99%

“…For the last round of AES, with the output ciphertext known, the input state byte can be calculated using Equation (2). For a warp of 32 threads, 32 such table lookups are running concurrently, and therefore we have:…”

Section: Calculating the Shared Memory Bank Indexmentioning

confidence: 99%

“…For each key byte value guessed (ranging from 0 to 255), we can calculate the correlation between the average timing and the number of bank conflicts, and use the correlation value to differentiate the correct key byte from other incorrect key guesses. For the data collected, the number of bank conflicts between the 32 threads falls in the range of [2,4].…”

Section: Recovering Key Bytesmentioning

confidence: 99%

“…We can always increase the number of samples to compensate for the noise, but it becomes impossible to attack the 32-key implementation. Recall that the number of bank conflicts falls into the range of [2,7]. To correctly compute two bank conflicts, we need to know memory accesses Exploiting Bank Conflict-based Side-channel Timing Leakage of GPUs 42:21 Fig.…”

Section: Unknown Key Mappingmentioning

confidence: 99%

“…(1) We quantify the effectiveness of our attack methodology using the success rate as a metric. (2) We extend our timing analysis onto other Nvidia GPU architectures: Maxwell, Pascal, Volta, and Turing. We explore how non-blocking execution can hide timing leakage in Shared Memory and be used to prevent our attack.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Exploiting Bank Conflict-based Side-channel Timing Leakage of GPUs

Jiang

Fei

Kaeli

2019

ACM Trans. Archit. Code Optim.

View full text Add to dashboard Cite

To prevent information leakage during program execution, modern software cryptographic implementations target constant-time function, where the number of instructions executed remains the same when program inputs change. However, the underlying microarchitecture behaves differently when processing different data inputs, impacting the execution time of the same instructions. These differences in execution time can covertly leak confidential information through a timing channel. Given the recent reports of covert channels present on commercial microprocessors, a number of microarchitectural features on CPUs have been reexamined from a timing leakage perspective. Unfortunately, a similar microarchitectural evaluation of the potential attack surfaces on GPUs has not been adequately performed. Several prior work has considered a timing channel based on the behavior of a GPU's coalescing unit. In this article, we identify a second finer-grained microarchitectural timing channel, related to the banking structure of the GPU's Shared Memory. By considering the timing channel caused by Shared Memory bank conflicts, we have developed a differential timing attack that can compromise table-based cryptographic algorithms. We implement our timing attack on an Nvidia Kepler K40 GPU and successfully recover the complete 128-bit encryption key of an Advanced Encryption Standard (AES) GPU implementation using 900,000 timing samples. We also evaluate the scalability of our attack method by attacking an implementation of the AES encryption algorithm that fully occupies the compute resources of the GPU. We extend our timing analysis onto other Nvidia architectures: Maxwell, Pascal, Volta, and Turing GPUs. We also discuss countermeasures and experiment with a novel multi-key implementation, evaluating its resistance to our side-channel timing attack and its associated performance overhead. CCS Concepts: • Security and privacy → Hardware security implementation; Side-channel analysis and countermeasures; • Computer systems organization → Single instruction, multiple data;

show abstract