1 An Introduction to Timing Attacks |
|
1 | (12) |
|
|
3 | (3) |
|
1.1.1 Side-Channel Attack Requirements |
|
|
4 | (1) |
|
1.1.2 The Attacker's Success |
|
|
5 | (1) |
|
1.1.3 Side-Channel Attack Suppression |
|
|
5 | (1) |
|
|
6 | (4) |
|
1.2.1 Kocher's Timing Attack |
|
|
7 | (2) |
|
1.2.2 Taxonomy of Timing Attacks |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
11 | (2) |
2 Modern Cryptography |
|
13 | (24) |
|
2.1 Types of Encryption Algorithms |
|
|
13 | (2) |
|
2.2 Block Ciphers: An Important Family of Symmetric-Key Ciphers |
|
|
15 | (9) |
|
|
16 | (4) |
|
|
20 | (3) |
|
|
23 | (1) |
|
2.3 Classical Cryptanalysis |
|
|
24 | (5) |
|
2.3.1 Classical Cryptanalysis of Block Ciphers |
|
|
25 | (1) |
|
2.3.2 The Idea of Differential in Block Ciphers |
|
|
25 | (4) |
|
2.4 Asymmetric-Key Ciphers |
|
|
29 | (1) |
|
2.5 RSA: An Asymmetric-Key Algorithm |
|
|
29 | (2) |
|
2.5.1 Square and Multiply Algorithm to Perform Exponentiation |
|
|
30 | (1) |
|
2.6 Confinement Problem and Covert Channels |
|
|
31 | (1) |
|
2.7 Formal Analysis of Side-Channel Attacks |
|
|
32 | (1) |
|
|
33 | (1) |
|
|
34 | (3) |
3 Superscalar Processors, Cache Memories, and Branch Predictors |
|
37 | (16) |
|
3.1 Superscalar Processors |
|
|
37 | (2) |
|
3.2 Memory Hierarchy and Cache Memory |
|
|
39 | (6) |
|
3.2.1 Organization of Cache Memory |
|
|
40 | (3) |
|
3.2.2 Improving Cache Performance for Superscalar Processors |
|
|
43 | (2) |
|
3.3 Branch Prediction Unit |
|
|
45 | (5) |
|
3.3.1 Static Branch Prediction |
|
|
47 | (1) |
|
3.3.2 Dynamic Branch Prediction Schemes |
|
|
47 | (3) |
|
3.3.3 Branch Target Buffers |
|
|
50 | (1) |
|
|
50 | (1) |
|
|
51 | (2) |
4 Time-Driven Cache Attacks |
|
53 | (18) |
|
4.1 A Simple Illustration |
|
|
53 | (4) |
|
4.1.1 Relation Between Size and Bits Revealed |
|
|
55 | (1) |
|
4.1.2 Relation Between Alignment of Tables and Bits Revealed |
|
|
56 | (1) |
|
4.1.3 Initial State of Cache Memory |
|
|
56 | (1) |
|
4.2 Collisions from Execution Time |
|
|
57 | (6) |
|
4.2.1 Clocks Using Hardware Time Stamp Counters |
|
|
57 | (2) |
|
4.2.2 Clocks with Virtual Time-Stamp Counters |
|
|
59 | (1) |
|
4.2.3 Distinguishing Cache Hit and Miss Events Using Time |
|
|
60 | (3) |
|
4.3 Timing Attacks on Block Ciphers Based on Internal Collisions |
|
|
63 | (3) |
|
4.3.1 Max, Min, or Max Deviation |
|
|
65 | (1) |
|
4.4 Time-Driven Attack Based on Induced Cache Miss |
|
|
66 | (3) |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
69 | (2) |
5 Advanced Time-Driven Cache Attacks on Block Ciphers |
|
71 | (10) |
|
5.1 Second Round Attack on AES |
|
|
71 | (1) |
|
5.2 Differential Cache Attacks on Feistel Ciphers |
|
|
72 | (3) |
|
5.3 Differential Cache Attack on CLEFIA |
|
|
75 | (4) |
|
5.3.1 Differential Properties of CLEFIA's F Functions |
|
|
75 | (1) |
|
5.3.2 Determining RKO and RK1 |
|
|
76 | (1) |
|
5.3.3 Determining WKO circled plus RK2 and WK1 circled plus RK3 |
|
|
77 | (1) |
|
5.3.4 Determining RK4 and RK5 |
|
|
78 | (1) |
|
5.3.5 Determining RK2 and RK3 |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
80 | (1) |
6 A Formal Analysis of Time-Driven Cache Attacks |
|
81 | (58) |
|
6.1 Memory Access Model for a Block Cipher |
|
|
81 | (1) |
|
6.2 Cache Misses in a Block Cipher |
|
|
82 | (3) |
|
6.3 Average Execution Time of a Block Cipher |
|
|
85 | (3) |
|
6.3.1 Estimating the Difference of Means |
|
|
87 | (1) |
|
6.4 DOM as a Security Metric |
|
|
88 | (2) |
|
6.5 Application of the Model |
|
|
90 | (49) |
10 Countermeasures for Timing Attacks |
|
139 | (12) |
|
10.1 Application Level Countermeasures |
|
|
139 | (4) |
|
10.1.1 Countermeasures Involving Look-Up Tables |
|
|
140 | (2) |
|
10.1.2 Data-Oblivious Memory Access Pattern |
|
|
142 | (1) |
|
10.1.3 Constant and Random Time Implementations |
|
|
142 | (1) |
|
10.2 Countermeasures Applied in the Hardware |
|
|
143 | (3) |
|
10.2.1 Noncached Memory Accesses |
|
|
143 | (1) |
|
10.2.2 Specialized Cache Designs |
|
|
143 | (1) |
|
10.2.3 Specialized Instructions |
|
|
144 | (1) |
|
10.2.4 Hardware Prefetching |
|
|
145 | (1) |
|
|
145 | (1) |
|
10.3 Countermeasures in the Operating System |
|
|
146 | (1) |
|
|
147 | (1) |
|
|
147 | (4) |
Appendix A: CPUs Used for Experiments |
|
151 | |