YACHT: Yet Another CacHe Timing Attack

Cesar Pereida Garcı́a

Abstract—Cache attacks are a subset of microarchitecture difficult and a complex job for engineers and mathemati-
attacks, which are currently gaining traction due to the serious cians. Engineers are advised not to implement their own
impact they represent to current microprocessor architecture. cryptography but instead, to rely on existing solutions that
Moreover, cache attacks against cryptography libraries such are trustworthy and have been continually tested over long
as OpenSSL, LibreSSL and BoringSSL have proved to be periods of time, one such solution is the OpenSSL library.
feasible and relevant due to the increasing trend of cloud OpenSSL1 is an open source project that started in
computing, multi-user computing and shared resources over December 1998 as a fork of SSLeay by Eric Andrew
the last decade. The goal of this work is to present the Young and Tim Hudson. Its original goal was to develop
current ongoing research on cache attacks, more specifically encryption tools for the growing Internet, but nowadays it
in cryptography library implementations using state-of-the-art does much more than that. OpenSSL can be divided in
cache attack techniques. three general modules: a cryptographic library, an SSL/TLS
library and toolkit, and command line tools. The command
line tools are linked against the other two modules and
1. Introduction provide an interface to create and execute cryptographic
objects and SSL/TLS operations. The SSL/TLS library and
Cryptographic primitive proposals are expected to be toolkit contains network protocols and extensions and it
accompanied by an extensive description of the security uses the cryptographic library to provide security. Finally,
assurance and its proofs demonstrating resistance to known and relevant to this work, the cryptographic library contains
cryptanalytic techniques. Such proofs are defined within the implementation of several standardized cryptographic
a security model which contains assumptions about the primitives including encryption, decryption, hash functions,
abilities of a given attacker. In order for a primitive proposal digital signatures and key exchange.
to be accepted, it must make its way from the formal OpenSSL is maintained by small group of core develop-
written specification to a concrete software or hardware ers which are mostly volunteers. Unfortunately, this situation
implementation. This task is inevitably the burden of an impacts the development decisions and the quality of the
engineer. code base, since security assurance and code correctness
More often than not, security issues occur when leaping can be hard to achieve in a project of such magnitude. Fur-
from paper to practice. A natural concern is how well the thermore, the developers favor portability over optimization,
physical implementation of the primitive preserves the as- this allowed a rapid adoption during the early days of the
sumptions of the security model. On the one hand, efficiency library and it has helped to become the de facto standard
is required for practical implementations of cryptography to for Internet security, in addition to a prime security attack
be usable, and achieving that efficiency may compromise the target [1].
security of such implementations. On the other hand, pro- As mentioned before, due to its widespread usage and
viding the maximum security without considering efficiency impact on the security of Internet, OpenSSL is a popular
may result in slow, unusable cryptography implementations. target for several types of attacks including cache attacks.
Therefore, achieving both requirements is a non-trivial task Assessment of cache attacks on cryptography and their
for engineers, since a wrong implementation lead to leakage mitigations are non-trivial tasks and therefore this can be a
of information. long and time consuming process for the developing team.
Cryptography engineering is a building block of security, Moreover, new attacks paired with inevitable software bugs,
privacy and anonymity in software and hardware. It needs defects and flaws make the work of securing the Internet an
to provide these attributes while being efficient at the same arduous task.
time, therefore achieving these properties is difficult and The goal of the current research is twofold: to find and
opens the possibility to defects. Additionally, the intricacies exploit cryptography flaws using cache attack techniques
of cryptographic algorithms and protocols enable flaws and
pitfalls, therefore the development of cryptography is a 1. https://www.openssl.org/
on multiple cryptography libraries such as OpenSSL; and P ROBE [6], F LUSH +R ELOAD [7], and F LUSH +F LUSH [8].
to increase the security of the users through patches and The previous techniques are still relevant and have advan-
mitigations for the flaws discovered. tages and disadvantages depending on the attack scenario.
More importantly, the F LUSH +R ELOAD technique is the
2. Microarchitecture attacks most relevant technique for this work due to its granularity
in a single cache line. Figure 1 shows a trace obtained using
A microarchitecture is the hardware implementation of the F LUSH +R ELOAD technique targeting OpenSSL.
an instruction set architecture (ISA) for a processor. Several The F LUSH +R ELOAD techniques works by evicting a
microarchitecture features exist to improve the average per- target memory location using the clflush instruction.
formance of the processor: (1) a data cache is a low capacity After the data has been evicted from the cache, the data
and high speed memory located on the CPU—it temporarily is reloaded into the cache and timed. The time determines
fetches and stores data values retrieved from slower main if the data was reloaded into the cache by another pro-
memory so that subsequent requests can be served quicker; cess running in parallel. Recent research uses the F LUSH +
(2) an instruction cache is mostly analogous to a data cache, R ELOAD technique in clever ways targeting the kernel [9],
but temporarily fetches and stores instruction values to be web server function calls [10], user input [11], [12], covert
executed; (3) a branch predictor is a digital circuit on the channels [13] in addition to cryptographic algorithms [2],
CPU that guesses the outcome of logic branches, fetches [14].
the resulting instructions, and speculatively executes them Research in cache attacks has developed the tools to
to avoid pipeline stall. perform more specialized and powerful microarchitecture
Unfortunately, these microarchitecture features introduce attacks as recently demonstrated by the Meltdown [15] and
side-channels due to hidden states observed through pro- the Spectre [16] attacks.
gram execution characteristics (e.g. timing): (1) data cache-
timing attacks [2]; (2) instructing cache-timing attacks [3]; 3. Related Work
(3) branch predictor attacks [4]. This subset of side-channel
attacks are known as microarchitecture attacks and are a In his seminal work, Colin Percival [6] discusses that
serious threat to security critical software. shared access to memory caches between threads can be
Microarchitectures were not developed with security as used as a covert channel and also permits to monitor the ex-
a priority, and several attacks on different components are ecution of other threads. Moreover, the author demonstrated
a proof of it. When developing countermeasures, software that the Sliding Window Exponentiation implementation of
updates are relatively easy to distribute but retiring or up- modular exponentiation in OpenSSL version 0.9.7c is vul-
grading hardware in a massive scale is not viable due to nerable to cache-timing attacks, applied to recover RSA pri-
time and costs. vate keys, by identifying access to pre-computed multipliers
stored in memory. Following the issue, the OpenSSL team
2.1. Cache Attacks introduced a code change to mitigate the attack. OpenSSL
added a “constant-time” implementation of modular expo-
Accessing data and instructions from main memory is nentiation, this implementation combines a fixed-window
not an instant operation since it takes time to locate and to exponentiation algorithm with a scatter-gather method [17],
load the data, thus it delays the execution of the processors. allowing to mask table access to the multipliers. The scatter-
Caches are small and fast memory banks used by processors gather method ensures that the same cache lines are always
to improve the execution performance. The performance is accessed, irrespective of the multiplier used.
improved by exploiting spacial and temporal locality of the Acıiçmez et al. [18] demonstrate Simple Branch Pre-
memory access. In other words, data that is accessed several diction Analysis (SBPA) a new class of analysis under
times during the same program, is cached (i.e. temporal cache-timing attacks. Previous research effort focused on
locality). And data close to the accessed data will be cached the modular exponentiation operation due to the relevance
too (i.e. spatial locality). Modern CPUs contain multiple across several cryptosystems, however, the authors show
cache levels, both private and shared among cores. is not the only operation leaking secret information. They
Cache attacks are a subset of microarchitecture attacks, show information leakage in OpenSSL 0.9.8a during the
targeting specifically the cache. Cache attacks against cryp- modular inversion operation due to the use of the Binary
tographic implementations exploit two different but impor- Extended Euclidean Algorithm (BEEA). The BEEA is used
tant features, the timing variation introduced by the cache during decryption in RSA-CRT and during the blinding
hierarchy and the non-constant time execution of crypto- process, and this requires computations on secret values. The
graphic algorithms. Thus, a motivated attacker can correlate authors prove it is theoretically possible to recover the input
the cache timing data, the execution time of the algorithm, values to the BEEA algorithm and therefore recover secret
its internal state during execution and the output of the information. Finally, they continue and modify OpenSSL
algorithm to ultimately recover confidential information. with proper countermeasures to prevent this attack.
Several techniques to attack the cache hierarchy have More recently, Yarom et al. [19] showed that the scatter-
been proposed and used successfully to mount cache attack, gather method implemented in OpenSSL is not “constant-
these techniques include E VICT +R ELOAD [5], P RIME + time” as it was believed. In their work, the authors demon-
 S probe
L probe
Latency

0 50000 100000 150000 200000 250000 300000 350000 400000

Figure 1. Raw trace captured using the F LUSH +R ELOAD technique during the executions of a cryptographic primitive and tracking two different operations.
Latency is scaled and normalized. For visualization, focus on the amplitude peaks, i.e. low latency.

strate that even if the same cache lines are always accessed, general way of translating operations into bits exist since
the offset accessed within the cache line depends on the all depends on the algorithm in use and often such a way
multiplier used, which is decided based on the private key. does not exist at all. This is a decisive step in an attack, if
To that end, the authors exploit cache-bank conflicts. A the attacker cannot translate operations into bits or the bit
cache is often divided in cache banks. These banks allow leakage is too small then the attack will not be possible.
concurrent access to the cache, but cache banks can handle Once the bit leakage is measured and proved sufficient,
only one request at a time. If multiple requests are made to the attacker has to decide how to use those bits. Different
the same cache bank, a cache-bank conflict occurs and the cryptographic primitives have different ways of maximizing
conflicting requests are delayed, creating a timing variation. bit leakage but mathematical objects are a common approach
The timing variations allowed to perform an attack against at this stage of an attack. Depending on the bits leaked, the
OpenSSL 1.0.2f, leading to 4096-bit RSA key recovery after attack may require massive computational resources, making
observing 16, 000 decryptions. the attack unfeasible in practice, at least for the time being.
RSA has been the target of several attacks throughout The current research emphasizes in the OpenSSL imple-
the years due to its relevance and widespread usage on the mentation of the RSA cryptosystem with respect to cache
Internet. Attacks to RSA are not limited to cache attacks, attacks. As mentioned earlier, RSA is widely deployed and
also timing attacks, power analysis attacks, small exponent used and therefore a successful attack against the cryptosys-
attacks, prime factorization attacks and partial information tem will have a big impact on the security of the Internet.
attacks have been successfully exploited. Likewise, attackers
have targeted every aspect of the cryptosystem: encryption, 5. Conclusion
decryption, key generation, signing and verification but it
stands the test of time. The cryptosystem has evolved and As observed previously, cryptography libraries have a
attacks are harder to perform but as demonstrated by Nemec questionable track record when it comes to microarchitec-
et al. [20], the cryptosystem is extremely popular despite ture attacks. Flaws in mitigations, challenging countermea-
the development of Elliptic Curve Cryptography and more sures that do not stand the test of time and underestimation
recently Post-Quantum Cryptography. of attacks are common issues when dealing with microar-
chitecture attacks.
4. Current Research In the case of OpenSSL, rapid changes to the code base
paired with regular changes and releases, complicate the
The newest OpenSSL versions 1.1.0 and 1.1.1 introduce task of tracking possible leakages. Moreover, due to the
the biggest changes to the code base with a “security first” requirement to support several architectures is possible to
mindset. Nevertheless, these two versions have been around find multiple implementations of an algorithm with different
for a relatively short amount of time, thus it is possible they levels of security with respect to information leakage.
contain security flaws and side-channel leakages. In addition, security flags were introduced into the code
This work focuses on finding and exploiting new and base to identify and protect against newly discovered attacks
existing information leakages using cache attacks. The cur- in specific cases and scenarios. Nevertheless, these scenarios
rent development of cache attack techniques, mathematical are now the norm instead of the exception, therefore the
techniques and computational resources help to discover task of tracking all the cases where these flags are needed
leakage and exploit them. is paramount, and is very likely that many more cases will
Leakage detection and trace acquisition are only the go unnoticed [21], [22].
first steps towards a full attack. Typically, a trace reveals
only a sequence of operations (e.g. square, multiply, double,
add, right shift, left shift) performed during the execution
of an algorithm. This sequence of operations needs to be
converted into information, more precisely, into bits. No
References [12] M. Lipp, D. Gruss, R. Spreitzer, C. Maurice, and S. Mangard,
“Armageddon: Cache attacks on mobile devices,” in 25th USENIX
Security Symposium, USENIX Security 16, Austin, TX, USA, August
[1] C. Meyer and J. Schwenk, “SoK: Lessons learned from SSL/TLS
10-12, 2016., 2016, pp. 549–564.
attacks,” in Information Security Applications - 14th International
Workshop, WISA 2013, Jeju Island, Korea, August 19-21, 2013, [13] C. Maurice, C. Neumann, O. Heen, and A. Francillon, “C5: cross-
Revised Selected Papers, ser. Lecture Notes in Computer Science, cores cache covert channel,” in Detection of Intrusions and Malware,
Y. Kim, H. Lee, and A. Perrig, Eds., vol. 8267. Springer, and Vulnerability Assessment - 12th International Conference,
2013, pp. 189–209. [Online]. Available: https://doi.org/10.1007/ DIMVA 2015, Milan, Italy, July 9-10, 2015, Proceedings, ser.
978-3-319-05149-9 12 Lecture Notes in Computer Science, M. Almgren, V. Gulisano, and
[2] B. B. Brumley and R. M. Hakala, “Cache-timing template F. Maggi, Eds., vol. 9148. Springer, 2015, pp. 46–64. [Online].
attacks,” in Advances in Cryptology - ASIACRYPT 2009, 15th Available: https://doi.org/10.1007/978-3-319-20550-2 3
International Conference on the Theory and Application of [14] N. Benger, J. van de Pol, N. P. Smart, and Y. Yarom, ““ooh aah...
Cryptology and Information Security, Tokyo, Japan, December just a little bit” : A small amount of side channel can go a long way,”
6-10, 2009. Proceedings, ser. Lecture Notes in Computer Science, in Cryptographic Hardware and Embedded Systems - CHES 2014 -
M. Matsui, Ed., vol. 5912. Springer, 2009, pp. 667–684. [Online]. 16th International Workshop, Busan, South Korea, September 23-26,
Available: https://doi.org/10.1007/978-3-642-10366-7 39 2014. Proceedings, ser. Lecture Notes in Computer Science, L. Batina
[3] O. Acıiçmez, B. B. Brumley, and P. Grabher, “New results and M. Robshaw, Eds., vol. 8731. Springer, 2014, pp. 75–92.
on instruction cache attacks,” in Cryptographic Hardware and [Online]. Available: https://doi.org/10.1007/978-3-662-44709-3 5
Embedded Systems, CHES 2010, 12th International Workshop, [15] M. Lipp, M. Schwarz, D. Gruss, T. Prescher, W. Haas, S. Mangard,
Santa Barbara, CA, USA, August 17-20, 2010. Proceedings, ser. P. Kocher, D. Genkin, Y. Yarom, and M. Hamburg, “Meltdown,”
Lecture Notes in Computer Science, S. Mangard and F. Standaert, CoRR, vol. abs/1801.01207, 2018. [Online]. Available: http:
Eds., vol. 6225. Springer, 2010, pp. 110–124. [Online]. Available: //arxiv.org/abs/1801.01207
https://doi.org/10.1007/978-3-642-15031-9 8
[16] P. Kocher, D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp,
[4] O. Acıiçmez, Ç. K. Koç, and J. Seifert, “Predicting secret keys via S. Mangard, T. Prescher, M. Schwarz, and Y. Yarom, “Spectre attacks:
branch prediction,” in Topics in Cryptology - CT-RSA 2007, The Exploiting speculative execution,” CoRR, vol. abs/1801.01203, 2018.
Cryptographers’ Track at the RSA Conference 2007, San Francisco, [Online]. Available: http://arxiv.org/abs/1801.01203
CA, USA, February 5-9, 2007, Proceedings, ser. Lecture Notes in
Computer Science, M. Abe, Ed., vol. 4377. Springer, 2007, pp. [17] E. Brickell, G. Graunke, M. Neve, and J. Seifert, “Software
225–242. [Online]. Available: https://doi.org/10.1007/11967668 15 mitigations to hedge AES against cache-based software side channel
vulnerabilities,” IACR Cryptology ePrint Archive, vol. 2006, p. 52,
[5] D. A. Osvik, A. Shamir, and E. Tromer, “Cache attacks and 2006. [Online]. Available: http://eprint.iacr.org/2006/052
countermeasures: The case of AES,” in Topics in Cryptology -
CT-RSA 2006, The Cryptographers’ Track at the RSA Conference [18] O. Aciiçmez, S. Gueron, and J. Seifert, “New branch
2006, San Jose, CA, USA, February 13-17, 2006, Proceedings, prediction vulnerabilities in OpenSSL and necessary software
ser. Lecture Notes in Computer Science, D. Pointcheval, Ed., countermeasures,” in Cryptography and Coding, 11th IMA
vol. 3860. Springer, 2006, pp. 1–20. [Online]. Available: https: International Conference, Cirencester, UK, December 18-20,
//doi.org/10.1007/11605805 1 2007, Proceedings, 2007, pp. 185–203. [Online]. Available:
http://dx.doi.org/10.1007/978-3-540-77272-9 12
[6] C. Percival, “Cache missing for fun and profit,” in BSDCan 2005,
Ottawa, Canada, May 13-14, 2005, Proceedings, 2005. [Online]. [19] Y. Yarom, D. Genkin, and N. Heninger, “CacheBleed: A timing attack
Available: http://www.daemonology.net/papers/cachemissing.pdf on openssl constant time RSA,” in Cryptographic Hardware and
Embedded Systems - CHES 2016 - 18th International Conference,
[7] Y. Yarom and K. Falkner, “FLUSH+RELOAD: A high Santa Barbara, CA, USA, August 17-19, 2016, Proceedings, ser.
resolution, low noise, L3 cache side-channel attack,” in Lecture Notes in Computer Science, B. Gierlichs and A. Y.
Proceedings of the 23rd USENIX Security Symposium, Poschmann, Eds., vol. 9813. Springer, 2016, pp. 346–367. [Online].
San Diego, CA, USA, August 20-22, 2014., 2014, pp. Available: https://doi.org/10.1007/978-3-662-53140-2 17
719–732. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity14/technical-sessions/presentation/yarom [20] M. Nemec, M. Sýs, P. Svenda, D. Klinec, and V. Matyas, “The
return of coppersmith’s attack: Practical factorization of widely used
[8] D. Gruss, C. Maurice, K. Wagner, and S. Mangard, “Flush+flush: RSA moduli,” in Proceedings of the 2017 ACM SIGSAC Conference
A fast and stealthy cache attack,” in Detection of Intrusions on Computer and Communications Security, CCS 2017, Dallas, TX,
and Malware, and Vulnerability Assessment - 13th International USA, October 30 - —November 03, 2017, B. M. Thuraisingham,
Conference, DIMVA 2016, San Sebastián, Spain, July 7-8, D. Evans, T. Malkin, and D. Xu, Eds. ACM, 2017, pp. 1631–1648.
2016, Proceedings, ser. Lecture Notes in Computer Science, [Online]. Available: http://doi.acm.org/10.1145/3133956.3133969
J. Caballero, U. Zurutuza, and R. J. Rodrı́guez, Eds., vol.
9721. Springer, 2016, pp. 279–299. [Online]. Available: https: [21] C. Pereida Garcı́a, B. B. Brumley, and Y. Yarom, ““Make
//doi.org/10.1007/978-3-319-40667-1 14 sure DSA signing exponentiations really are constant-time”,” in
Proceedings of the 2016 ACM SIGSAC Conference on Computer
[9] R. Hund, C. Willems, and T. Holz, “Practical timing side channel
and Communications Security, Vienna, Austria, October 24-28, 2016,
attacks against kernel space ASLR,” in 20th Annual Network and
E. R. Weippl, S. Katzenbeisser, C. Kruegel, A. C. Myers, and
Distributed System Security Symposium, NDSS 2013, San Diego,
S. Halevi, Eds. ACM, 2016, pp. 1639–1650. [Online]. Available:
California, USA, February 24-27, 2013, 2013.
http://doi.acm.org/10.1145/2976749.2978420
[10] Y. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Cross-tenant
[22] C. Pereida Garcı́a and B. B. Brumley, “Constant-time callees
side-channel attacks in paas clouds,” in Proceedings of the 2014 ACM
with variable-time callers,” in 26th USENIX Security Symposium,
SIGSAC Conference on Computer and Communications Security,
USENIX Security 2017, Vancouver, BC, Canada, August 16-18,
Scottsdale, AZ, USA, November 3-7, 2014, G. Ahn, M. Yung,
2017., E. Kirda and T. Ristenpart, Eds. USENIX Association, 2017,
and N. Li, Eds. ACM, 2014, pp. 990–1003. [Online]. Available:
pp. 83–98. [Online]. Available: https://www.usenix.org/conference/
http://doi.acm.org/10.1145/2660267.2660356
usenixsecurity17/technical-sessions/presentation/garcia
[11] D. Gruss, R. Spreitzer, and S. Mangard, “Cache template attacks:
Automating attacks on inclusive last-level caches,” in 24th USENIX
Security Symposium, USENIX Security 15, Washington, D.C., USA,
August 12-14, 2015., 2015, pp. 897–912.