4 ms·

My first highly amateur idea was to modify the frequency scaling algorithm with some randomness. How stupid is my idea?

bragr 4y ago
I guess it depends on how much randomness you need to effectively mask the signal.
cylon13 4y ago
Any noise strong enough to have a good chance of hiding the signal would completely defeat the benefit of having dynamic frequency scaling in the first place, I think.
- sneak 4y ago
  Except that the processor can be doing other work during artificially induced noise delays, something not possible with delays introduced by lower mean frequency.
- bobbylarrybobby 4y ago
  What if you discretized the allowed frequencies and linked the rate at which the cpu could switch?
- staticassertion 4y ago
  An additional millisecond to your public key exchange is probably not going to matter - key exchange is pretty infrequent anyway.
teraflop 4y ago
Unfortunately, trying to defeat side-channel attacks by adding random noise usually only increases the number of samples required to extract information, rather than preventing the attack entirely. (You can blame the central limit theorem for this.)
- matthewdgreen 4y ago
  This is not entirely true. Or rather: it is true when the countermeasure is to add random delays to pad out overall timing, since one can simply collect more samples to obtain an average. And that may be what the OP is suggesting: just scale the frequency to random levels that are not quite the pre-programmed ones, which is very similar to adding random delays. (In practice this might actually work well enough to defeat delicate attacks.) However what I hoped the OP was suggesting is to add random instructions as a way to prevent the processor from switching power modes: sort of like tapping your phone screen occasionally to keep it from dimming. There are also other (unrelated) techniques that use randomness to eliminate side channels. One of the most basic anti-timing-attack countermeasures is to use RSA blinding in which a base C is first randomized by computing C^r mod N before that (random) result is combined with the secret key. The randomness can then be removed from the final result. This defeats attacks that depend on choosing or knowing the value C.
  - abiro 4y ago
    How about making operations constant time in application code by picking an upper bound which is acceptable for the application, but that is certainly longer than the actual CPU computation and then waiting until the upper bound to return the result? Eg. my app is performing digital signatures and I'm sure that they take <1ms CPU time, but performing digital signatures in 10ms is acceptable for my application, so when I perform a signature I measure the CPU time elapsed, say 0.5ms and then wait for 9.5ms.
    - matthewdgreen 4y ago
      What you are describing is called “quantization”. It has some disadvantages, one of which is that people tend to disable it the second they hit a use case that requires better performance. It is also sometimes possible to distinguish “doing nothing and waiting for a timer” from “actively computing the result” if you have other access (eg you can measure response time by making another connection.)
- kelseyfrog 4y ago
tester756 4y ago
How about returning the same frequency to OS every and change it every 10sec? 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 3.2 3.2 3.2 3.2 3.2 3.2 3.2 3.2 2.8 2.8 2.8 2.8 2.8 2.8 2.8 2.8 2.8 totally fake value
- Phlarp 4y ago
  The attack isn't nicely asking the computer "hey how fast are you running right now?" and then deriving the private key from that data. If that was the case the fix would be as simple as you laid out here. This attack works by measuring the absolute (wall) time that elapses during many crypto operations and deriving the speed / private keys based on statistical methods applied to that timing data. Side-channel attacks are by definition, attacks against unintentional information leakage by a machine. The laws of thermodynamics virtually ensure that side channel attacks will be a persistent issue as long as computers are made of matter and consume electricity, multi-tenant computing exacerbates the issue.
  - tester756 4y ago
    thank you
deleted 4y ago
[deleted]
minedwiz 4y ago
Oh man the overclocking community would just love it if Intel messed with the power scaling architecture </s>

I guess it depends on how much randomness you need to effectively mask the signal.

Any noise strong enough to have a good chance of hiding the signal would completely defeat the benefit of having dynamic frequency scaling in the first place, I think.

sneak 4y ago
Except that the processor can be doing other work during artificially induced noise delays, something not possible with delays introduced by lower mean frequency.
bobbylarrybobby 4y ago
What if you discretized the allowed frequencies and linked the rate at which the cpu could switch?
staticassertion 4y ago
An additional millisecond to your public key exchange is probably not going to matter - key exchange is pretty infrequent anyway.

teraflop 4y ago

Unfortunately, trying to defeat side-channel attacks by adding random noise usually only increases the number of samples required to extract information, rather than preventing the attack entirely. (You can blame the central limit theorem for this.)

matthewdgreen 4y ago
This is not entirely true. Or rather: it is true when the countermeasure is to add random delays to pad out overall timing, since one can simply collect more samples to obtain an average. And that may be what the OP is suggesting: just scale the frequency to random levels that are not quite the pre-programmed ones, which is very similar to adding random delays. (In practice this might actually work well enough to defeat delicate attacks.) However what I hoped the OP was suggesting is to add random instructions as a way to prevent the processor from switching power modes: sort of like tapping your phone screen occasionally to keep it from dimming. There are also other (unrelated) techniques that use randomness to eliminate side channels. One of the most basic anti-timing-attack countermeasures is to use RSA blinding in which a base C is first randomized by computing C^r mod N before that (random) result is combined with the secret key. The randomness can then be removed from the final result. This defeats attacks that depend on choosing or knowing the value C.
- abiro 4y ago
  How about making operations constant time in application code by picking an upper bound which is acceptable for the application, but that is certainly longer than the actual CPU computation and then waiting until the upper bound to return the result? Eg. my app is performing digital signatures and I'm sure that they take <1ms CPU time, but performing digital signatures in 10ms is acceptable for my application, so when I perform a signature I measure the CPU time elapsed, say 0.5ms and then wait for 9.5ms.
  - matthewdgreen 4y ago
    What you are describing is called “quantization”. It has some disadvantages, one of which is that people tend to disable it the second they hit a use case that requires better performance. It is also sometimes possible to distinguish “doing nothing and waiting for a timer” from “actively computing the result” if you have other access (eg you can measure response time by making another connection.)
kelseyfrog 4y ago

tester756 4y ago

How about returning the same frequency to OS every and change it every 10sec? 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 2.9 3.2 3.2 3.2 3.2 3.2 3.2 3.2 3.2 2.8 2.8 2.8 2.8 2.8 2.8 2.8 2.8 2.8 totally fake value

Phlarp 4y ago
The attack isn't nicely asking the computer "hey how fast are you running right now?" and then deriving the private key from that data. If that was the case the fix would be as simple as you laid out here. This attack works by measuring the absolute (wall) time that elapses during many crypto operations and deriving the speed / private keys based on statistical methods applied to that timing data. Side-channel attacks are by definition, attacks against unintentional information leakage by a machine. The laws of thermodynamics virtually ensure that side channel attacks will be a persistent issue as long as computers are made of matter and consume electricity, multi-tenant computing exacerbates the issue.
- tester756 4y ago
  thank you

deleted 4y ago

[deleted]

minedwiz 4y ago

Oh man the overclocking community would just love it if Intel messed with the power scaling architecture </s>