A Practical Methodology for Measuring the Side-Channel Signal Available to the Attacker for Instruction-Level Events

Callan, Robert; Zajić, Alenka; Prvulovic, Milos

doi:10.1109/micro.2014.39

Cited by 99 publications

(32 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this experiment, we have used electromagnetic pulses as fault injector. Using fault injection using electromagnetic pulses is a well-known technique and is extensively in literature [39][40][41][42][43]. The fault attack setup is shown in Fig.…”

Section: Experimental Validation Of Proposed Fault Based Forgery Attackmentioning

confidence: 99%

Two Efficient Fault-Based Attacks on CLOC and SILC

et al. 2017

View full text Add to dashboard Cite

CLOC and SILC are two block cipher-based authenticated encryption schemes, submitted to the CAE-SAR competition, that aims to use low area buffer and handle short input efficiently. The designers of CLOC and SILC claimed n 2 -bit integrity security against nonce-reusing adversaries, where n is the blockcipher state size in bits. In this paper, we present single fault-based almost universal forgeries on both CLOC and SILC with only one single bit fault at a fixed position of a specific blockcipher input. In the case of CLOC, the forgery can be done for almost any nonce, associated data and message triplet, except some nominal restrictions on associated data. In the case of SILC, the forgery can be done for almost any associated data and message, except some nominal restrictions on associated data along with a fixed nonce. Both the attacks on CLOC and SILC require several nonce-misusing encryption queries This attack is independent of the underlying block cipher and works on the encryption mode. In this paper, we also validate the proposed fault-based forgery methodology by performing actual fault attacks by electromagnetic pulse injection which shows practicality of the proposed forgery procedure. Next, we provide updated constructions that can resist the fault-based forgery on the mode assuming the underlying block cipher is fault resistant. Finally, we show that, if the underlying block cipher is not fault resistant, then for both CLOC and SILC, the key recovery can be done by injecting fault into the block cipher operations. We have considered the example with AES as the underlying block cipher. We would like to note that our attacks do not violate the designers' claims as our attacks require fault. However, it shows some vulnerability of the schemes when fault is feasible.

show abstract

Section: Experimental Validation Of Proposed Fault Based Forgery Attackmentioning

confidence: 99%

Two Efficient Fault-Based Attacks on CLOC and SILC

et al. 2017

View full text Add to dashboard Cite

show abstract

“…Microbenchmarks for generating such periodic activity have already been proposed for demonstrating the presence of EM emanations from computer systems [39] and for creating measurable periodic signals at arbitrary frequencies [11]. A simplified version of one such micro-benchmark is shown in Figure 6.…”

Section: Creating System Activity At Controlled Frequenciesmentioning

confidence: 99%

“…This alternation period T alt is the inverse of the frequency f alt = 1 T alt . Note that prior uses of similar micro-benchmarks [11,39] used this alternation to generate a carrier signal at some chosen frequency f c , while we use this alternation at f alt to measure AM-modulation of any potential carrier signals intrinsically generated (and emanated) by the system. As an example of how the alternation of activity can AMmodulate a carrier signal, consider the DRAM clock.…”

Section: Creating System Activity At Controlled Frequenciesmentioning

confidence: 99%

“…The closest work to ours is probably the use of similar microbenchmarks to generate simple (unmodulated) periodic signals at a desired frequency in order to enable measurement of overall potential for information leakage at the instruction level [11]. In contrast, we use micro-benchmark activity to modulate existing periodic signals to enable automatic identification of such activity-modulated periodic (carrier) signals.…”

Section: Related Workmentioning

confidence: 99%

“…Systematic instruction-level causation analysis for EM signals caused by direct emanations [3] has recently been developed [11]. However, that methodology depends on generating periodic activity at a frequency where precise measurements can be performed, i.e.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Fase

Callan

Zajić

Prvulovic

2015

Proceedings of the 42nd Annual International Symposium on Computer Architecture

Self Cite

View full text Add to dashboard Cite

While all computation generates electromagnetic (EM) side-channel signals, some of the strongest and farthestpropagating signals are created when an existing strong periodic signal (e.g. a clock signal) becomes stronger or weaker (amplitude-modulated) depending on processor or memory activity. However, modern systems create emanations at thousands of different frequencies, so it is a difficult, error-prone, and time-consuming task to find those few emanations that are AM-modulated by processor/memory activity. This paper presents a methodology for rapidly finding such activity-modulated signals. This method creates recognizable spectral patterns generated by specially designed microbenchmarks and then processes the recorded spectra to identify signals that exhibit amplitude-modulation behavior. We apply this method to several computer systems and find several such modulated signals. To illustrate how our methodology can benefit side-channel security research and practice, we also identify the physical mechanisms behind those signals, and find that the strongest signals are created by voltage regulators, memory refreshes, and DRAM clocks. Our results indicate that each signal may carry unique information about system activity, potentially enhancing an attacker's capability to extract sensitive information. We also confirm that our methodology correctly separates emanated signals that are affected by specific processor or memory activities from those that are not.

show abstract