Multibyte Microarchitectural Data Sampling and its Application to Session Key Extraction Attacks

Abstract

Microarchitectural data sampling (MDS) attacks leak secret data from the internal buffers of a processor to the attacker during transient execution. Because of the narrow window of transient execution, previous MDS attacks relied on repetitive sampling to obtain arbitrarily sized data from the buffer. However, as an MDS attacker cannot control the address for data leakage, such an approach significantly degrades the signal-to-noise ratio in the sampled data. In this paper, we propose a novel multibyte microarchitectural data sampling technique for performing MDS attacks. The proposed technique allows several continuous bytes to be captured in one execution without repetition of sampling. The implementation of the technique is quite challenging, because a transient execution window is not sufficiently large to allow multibyte sampling to be completed. We address this problem by leveraging a return stack buffer-based speculation technique, which originally was used for variants of Spectre-type attacks. We repurpose it to enlarge the transient execution window in our attack. Our implementations can capture data of up to 16 bytes in length in one execution from a line-fill buffer. To validate the effectiveness of the multibyte sampling technique, we demonstrate session key extraction attacks against secure network protocols. In particular, our objective is to extract AES-128 and AES-256 keys from TLS and SSH applications. To recover session keys in a postprocessing phase efficiently, we also propose a novel clustering-based search method that assembles the bytes of interest from the noisy sampled data. The experimental results show that our technique can successfully extract AES-128/256 session keys from victim applications with a probability of at least 98% and a reasonable search complexity. INDEX TERMS Microarchitectural data sampling, Transient execution attack, Session key extraction attackRecently, new vulnerabilities have been found on microarchitectural buffers inside some Intel processors [3], [4]. The

A keystone extension to defend against cache timing attacks

“…The time difference between cache misses and cache hits is illustrated in Figure 2. Flush+Reload [9] and Prime+Probe [10] are commonly used techniques in cache side-channel attacks. They leverage the response time differences between cache hits and misses to observe the execution state of sensitive programs left in the CPU cache.…”

“…The Last Level Cache (LLC) is shared among Enclaves and operating systems without trust, requiring eapp programmers to utilize other software or hardware solutions to mitigate cache timing channel vulnerabilities. Furthermore, Anh-Tien Le and others [8] have experimentally demonstrated that Spectre [9] attack techniques can exploit Cache timing attacks to breach the isolation of the Keystone framework, extracting protected data from the LLC.…”