Template attacks on ECC implementations using performance counters in CPU

PMUSpill: The Counters in Performance Monitor Unit that Leak SGX-Protected Secrets

“…With PMU, we can gain insight into the processor's behaviors such as the number of instructions that are assigned to a particular port, the number of cache misses/hits at different levels in the memory hierarchy, the number of mis-predicted branches, et al It is initially designed for software developers to analyze the code execution efficiency and therefore help them to optimize their applications. However, because it is capable to disclose the impacts of an instruction on the processor in a fine-grained manner, the researchers have also try to utilize the PMU to achieve other aims such as reverse engineering the black-box processors [42,45,49], and inferring the keys of encryption algorithms [4,5,16].…”

“…PMU provides a lot of information about the execution processes of instructions, which have been verified useful to achieve side channel attacks for inferring the keys of encryption algorithms. For example, Uhsadel et al [47] and Götzfried et al [16] use the PMU counters that measure the number of L1-cache hits or misses to implement the access-driven cache-timing attack on the AES implementation in the OpenSSL library; Bhattacharya et al [5] propose to use the PMU counters that measure the number of branch misses to compromise keys of RSA; Asvija et al [4] propose to attack the ECC by using the power-related counters to implement the template attack.…”

“…Over the past few years, researchers have found that SGX's security still needs to be improved. It has always been challenged by side channel attacks [4,5,6,16], but transient execution attacks have also been found shortcomings of Intel SGX's security in recent years. For example, the Spectre-like attack proposed by Chen et al [9] can poison the Branch Target Buffer (BTB) in the enclave and uses the processor's branch prediction mechanism to leak trusted data; ZombieLoad attack [45] uses the LFB to leak the SGX-protected data; Foreshadow attack [48] maps the physical address of the enclave to an inaccessible virtual address, whose access will generate a faulting load.…”

“…It is essentially designed as a tool to collect the activities of processor for software developers to analyze and optimize their codes. However, PMU provides plentiful information about the behaviors of processor, which provides opportunities for researchers to reverse engineering the design details of black-box processors [34,42,45,49] or speculate the keys of encryption algorithms such as Advanced Encryption Standard (AES) [16], Rivest-Shamir-Adleman (RSA) [5], and Elliptic Curves Cryptography (ECC) [4]. While this study shows a new security issue caused by PMU that is not studied before as we know: leaking the secret data that are loaded during transient executions.…”