A novel cache bank timing attack

Abstract

To avoid information leakage through execution, modern software implementations of cryptographic algorithms target constant timing complexity, i.e., the number of instructions does not vary with different inputs. However, often times, the underlying microarchitecture behaves differently under different data inputs, which covertly leaks confidential information through the timing channel. Cache timing channel due to cache miss penalties has been explored in recent years to break system security. In this paper, we exploit a finer-grained L1 cache bank timing channel, the stalling delay due to cache bank conflicts, and develop a new timing attack against table lookup-based cryptographic algorithms. We implement the timing attack with three different methods on Sandy Bridge micro-architecture, and successfully recover the complete 128-bit AES encryption key. The most effective attack can achieve 50% success rate using 75,000 samples and 100% success rate using 200,000 samples. The whole attack process from collecting samples to recoverying all key bytes takes less than 3 minutes. We anticipate the new timing attack to be a threat to various platforms, including ARM-based smart phones and performance-critical accelerators like GPUs.