4 ms·

Does this mean that an evil process may gain information about a foreign process by measuring its own execution speed variations?

Phlarp 4y ago
That is my reading of the text on the linked page. >We have demonstrated how a clever attacker can use a novel chosen-ciphertext attack against SIKE to perform full key extraction via remote timing, despite SIKE being implemented as “constant time”.
- hinkley 4y ago
  That's a big problem. If you created an algorithm that evaluated all possible 32 bit inputs in parallel and then picked the correct value at the end based on the input, you'd still have some funky corner case where the branch predictor in your x64 processor spilled the beans. Are we going to have to design our crypto algorithms entirely on SIMD instructions to combat this sort of thing?
  - Phlarp 4y ago
    >Are we going to have to design our crypto algorithms entirely on SIMD instructions to combat this sort of thing? There is likely still potential for side channel attacks. From a 'first principles' approach a computer is always going to leak information about it's current state (power, noise, emi, etc) and the methods / tools / techniques for analyzing that leaking information are only getting better. The multi-tenant nature of modern infrastructure is the bigger issue in play here.
  - bombcar 4y ago
    It sounds like there's some mitigations available for the crypto libraries, but perhaps defense-in-depth is going to require the libraries to do "junk work" to obfuscate what's happening against future attacks like this. (I wonder if one is possible if the same key were to be used on different processors, if that would leak certain information, for example.)
hinkley 4y ago
The 'S' in 'RSA' is Adi Shamir, who has spent a lot of his career analyzing side-channel attacks. It is especially a problem with special-purpose cryptographic hardware because it tends to be within a small multiple of 'just enough' hardware to do the task. It's a lot easier to spot a 2% increase in processing time (or for that matter, current draw) when the hardware only runs one task, and the task is dominated by CPU time rather than other factors. But analysis tools only get better over time, so the scenarios where they are useful multiply.
jackcook 4y ago
We did exactly this in a recent paper we're presenting at ISCA next week (see https://jackcook.github.io/bigger-fish/ https://jackcook.github.io/bigger-fish/) -- it's very possible for an attacker to do this. However, we didn't find that the signal the attacker found was due to frequency variations (and we did run an experiment to test this), but rather due to system interrupts.

Phlarp 4y ago

That is my reading of the text on the linked page. >We have demonstrated how a clever attacker can use a novel chosen-ciphertext attack against SIKE to perform full key extraction via remote timing, despite SIKE being implemented as “constant time”.

hinkley 4y ago
That's a big problem. If you created an algorithm that evaluated all possible 32 bit inputs in parallel and then picked the correct value at the end based on the input, you'd still have some funky corner case where the branch predictor in your x64 processor spilled the beans. Are we going to have to design our crypto algorithms entirely on SIMD instructions to combat this sort of thing?
- Phlarp 4y ago
  >Are we going to have to design our crypto algorithms entirely on SIMD instructions to combat this sort of thing? There is likely still potential for side channel attacks. From a 'first principles' approach a computer is always going to leak information about it's current state (power, noise, emi, etc) and the methods / tools / techniques for analyzing that leaking information are only getting better. The multi-tenant nature of modern infrastructure is the bigger issue in play here.
- bombcar 4y ago
  It sounds like there's some mitigations available for the crypto libraries, but perhaps defense-in-depth is going to require the libraries to do "junk work" to obfuscate what's happening against future attacks like this. (I wonder if one is possible if the same key were to be used on different processors, if that would leak certain information, for example.)

hinkley 4y ago

The 'S' in 'RSA' is Adi Shamir, who has spent a lot of his career analyzing side-channel attacks. It is especially a problem with special-purpose cryptographic hardware because it tends to be within a small multiple of 'just enough' hardware to do the task. It's a lot easier to spot a 2% increase in processing time (or for that matter, current draw) when the hardware only runs one task, and the task is dominated by CPU time rather than other factors. But analysis tools only get better over time, so the scenarios where they are useful multiply.

jackcook 4y ago

We did exactly this in a recent paper we're presenting at ISCA next week (see https://jackcook.github.io/bigger-fish/ https://jackcook.github.io/bigger-fish/) -- it's very possible for an attacker to do this. However, we didn't find that the signal the attacker found was due to frequency variations (and we did run an experiment to test this), but rather due to system interrupts.