Cache-Access Pattern Attack on Disaligned AES T-Tables

Raphael Spreitzer, Thomas Plos

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Abstract

Cache attacks are a special form of implementation attacks and focus on the exploitation of weaknesses in the implementation of a specific algorithm. We demonstrate an access-driven cache attack, which is based on the analysis of memory-access patterns due to the T-table accesses of the Advanced Encryption Standard (AES). Based on the work of Tromer et al. we gather the cache-memory access patterns of AES T-table implementations and perform a pattern-matching attack in order to recover the used secret key. These T-tables usually do not start at memory addresses which are mapped to the beginning of a specific cache line. Thus, focusing on disaligned AES T-tables allows us to recover the whole secret key by considering only the first round of the AES. We apply the presented cache attack on a Google Nexus S smartphone, which employs a Cortex-A8 processor and runs a fully-functioning operating system. The attack is purely implemented in software and the only requirement is a rooted mobile device. To the best of our knowledge, we are the first to launch an access-driven attack on an ARM Cortex-A processor. Based on our observations of the gathered access patterns we also present an enhancement, which in some cases allows us to recover the secret key without a subsequent brute-force key search.
Original languageEnglish
Title of host publicationConstructive Side-Channel Analysis and Secure Design - COSADE 2013, 4th International Workshop, Paris, France, March 7-8, 2013, Proceedings.
PublisherSpringer
Pages200-214
Publication statusPublished - 2013
EventInternational Workshop on Constructive Side-Channel Analysis and Secure Design - Paris, France
Duration: 7 Mar 20138 Mar 2013

Publication series

NameLecture Notes in Computer Science
PublisherSpringer

Conference

ConferenceInternational Workshop on Constructive Side-Channel Analysis and Secure Design
CountryFrance
CityParis
Period7/03/138/03/13

Fingerprint

Cryptography
Data storage equipment
Cache memory
Pattern matching
Smartphones
Mobile devices

Fields of Expertise

  • Information, Communication & Computing

Treatment code (Nähere Zuordnung)

  • Application

Cite this

Spreitzer, R., & Plos, T. (2013). Cache-Access Pattern Attack on Disaligned AES T-Tables. In Constructive Side-Channel Analysis and Secure Design - COSADE 2013, 4th International Workshop, Paris, France, March 7-8, 2013, Proceedings. (pp. 200-214). (Lecture Notes in Computer Science). Springer.

Cache-Access Pattern Attack on Disaligned AES T-Tables. / Spreitzer, Raphael; Plos, Thomas.

Constructive Side-Channel Analysis and Secure Design - COSADE 2013, 4th International Workshop, Paris, France, March 7-8, 2013, Proceedings.. Springer, 2013. p. 200-214 (Lecture Notes in Computer Science).

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Spreitzer, R & Plos, T 2013, Cache-Access Pattern Attack on Disaligned AES T-Tables. in Constructive Side-Channel Analysis and Secure Design - COSADE 2013, 4th International Workshop, Paris, France, March 7-8, 2013, Proceedings.. Lecture Notes in Computer Science, Springer, pp. 200-214, International Workshop on Constructive Side-Channel Analysis and Secure Design, Paris, France, 7/03/13.
Spreitzer R, Plos T. Cache-Access Pattern Attack on Disaligned AES T-Tables. In Constructive Side-Channel Analysis and Secure Design - COSADE 2013, 4th International Workshop, Paris, France, March 7-8, 2013, Proceedings.. Springer. 2013. p. 200-214. (Lecture Notes in Computer Science).
Spreitzer, Raphael ; Plos, Thomas. / Cache-Access Pattern Attack on Disaligned AES T-Tables. Constructive Side-Channel Analysis and Secure Design - COSADE 2013, 4th International Workshop, Paris, France, March 7-8, 2013, Proceedings.. Springer, 2013. pp. 200-214 (Lecture Notes in Computer Science).
@inproceedings{57229311dcaa478ebea4ac149032a030,
title = "Cache-Access Pattern Attack on Disaligned AES T-Tables",
abstract = "Cache attacks are a special form of implementation attacks and focus on the exploitation of weaknesses in the implementation of a specific algorithm. We demonstrate an access-driven cache attack, which is based on the analysis of memory-access patterns due to the T-table accesses of the Advanced Encryption Standard (AES). Based on the work of Tromer et al. we gather the cache-memory access patterns of AES T-table implementations and perform a pattern-matching attack in order to recover the used secret key. These T-tables usually do not start at memory addresses which are mapped to the beginning of a specific cache line. Thus, focusing on disaligned AES T-tables allows us to recover the whole secret key by considering only the first round of the AES. We apply the presented cache attack on a Google Nexus S smartphone, which employs a Cortex-A8 processor and runs a fully-functioning operating system. The attack is purely implemented in software and the only requirement is a rooted mobile device. To the best of our knowledge, we are the first to launch an access-driven attack on an ARM Cortex-A processor. Based on our observations of the gathered access patterns we also present an enhancement, which in some cases allows us to recover the secret key without a subsequent brute-force key search.",
author = "Raphael Spreitzer and Thomas Plos",
year = "2013",
language = "English",
series = "Lecture Notes in Computer Science",
publisher = "Springer",
pages = "200--214",
booktitle = "Constructive Side-Channel Analysis and Secure Design - COSADE 2013, 4th International Workshop, Paris, France, March 7-8, 2013, Proceedings.",

}

TY - GEN

T1 - Cache-Access Pattern Attack on Disaligned AES T-Tables

AU - Spreitzer, Raphael

AU - Plos, Thomas

PY - 2013

Y1 - 2013

N2 - Cache attacks are a special form of implementation attacks and focus on the exploitation of weaknesses in the implementation of a specific algorithm. We demonstrate an access-driven cache attack, which is based on the analysis of memory-access patterns due to the T-table accesses of the Advanced Encryption Standard (AES). Based on the work of Tromer et al. we gather the cache-memory access patterns of AES T-table implementations and perform a pattern-matching attack in order to recover the used secret key. These T-tables usually do not start at memory addresses which are mapped to the beginning of a specific cache line. Thus, focusing on disaligned AES T-tables allows us to recover the whole secret key by considering only the first round of the AES. We apply the presented cache attack on a Google Nexus S smartphone, which employs a Cortex-A8 processor and runs a fully-functioning operating system. The attack is purely implemented in software and the only requirement is a rooted mobile device. To the best of our knowledge, we are the first to launch an access-driven attack on an ARM Cortex-A processor. Based on our observations of the gathered access patterns we also present an enhancement, which in some cases allows us to recover the secret key without a subsequent brute-force key search.

AB - Cache attacks are a special form of implementation attacks and focus on the exploitation of weaknesses in the implementation of a specific algorithm. We demonstrate an access-driven cache attack, which is based on the analysis of memory-access patterns due to the T-table accesses of the Advanced Encryption Standard (AES). Based on the work of Tromer et al. we gather the cache-memory access patterns of AES T-table implementations and perform a pattern-matching attack in order to recover the used secret key. These T-tables usually do not start at memory addresses which are mapped to the beginning of a specific cache line. Thus, focusing on disaligned AES T-tables allows us to recover the whole secret key by considering only the first round of the AES. We apply the presented cache attack on a Google Nexus S smartphone, which employs a Cortex-A8 processor and runs a fully-functioning operating system. The attack is purely implemented in software and the only requirement is a rooted mobile device. To the best of our knowledge, we are the first to launch an access-driven attack on an ARM Cortex-A processor. Based on our observations of the gathered access patterns we also present an enhancement, which in some cases allows us to recover the secret key without a subsequent brute-force key search.

M3 - Conference contribution

T3 - Lecture Notes in Computer Science

SP - 200

EP - 214

BT - Constructive Side-Channel Analysis and Secure Design - COSADE 2013, 4th International Workshop, Paris, France, March 7-8, 2013, Proceedings.

PB - Springer

ER -