<story><title>CacheBleed: A Timing Attack on OpenSSL Constant Time RSA</title><url>https://ssrg.nicta.com.au/projects/TS/cachebleed/</url></story><parent_chain></parent_chain><comment><author>pimterry</author><text>Side-channel attacks like this are always a little hard to follow, and there&amp;#x27;s a lot of detail in here, so here&amp;#x27;s my best synopsis of the technical details behind why this works:&lt;p&gt;In many modern Intel CPUs (all Sandy Bridge, maybe Nehalem and Core 2 too, not Haswell) you can get cache bank conflicts, where two instructions try to read the same bank (cross-cutting segment) of the CPU cache in quick succession. When that happens one of the instructions has to wait for the other to complete, so takes fractionally longer.&lt;p&gt;If you trigger a whole bunch of these cache bank conflicts yourself, while OpenSSL is working, you&amp;#x27;ll get tiny delays in your reads from parts of the cache that OpenSSL is using. If you do this an enormous number of times, you can then look at the accumulated average delays in your requests, and work out how OpenSSL&amp;#x27;s memory accesses are distributed over these banks.&lt;p&gt;Depending on the value of one part of the secret that OpenSSL is using to sign or decrypt data (specifically, the multipliers used in the multiplication steps in RSA), its access pattern for the cache is actually slightly biased. This is the bug. Once you know which banks are most active, you know the overall access pattern, and you can use this to drastically reduce the number of possibilities for each multiplier. That gives you enough information about the value of the key that with some subsequent offline processing you can recover the rest (apparently doable in about 3 minutes on a high-end CPU).&lt;p&gt;The fix is to ensure that the patterns of cache access that OpenSSL makes are totally independent of the secret data being used. The latest patch effectively does this, fixing the bug. You can still use cache bank conflicts to work out which bits of the cache OpenSSL is hitting, but that&amp;#x27;s no longer useful information.&lt;p&gt;(I think this is broadly right; I&amp;#x27;d love to know if there&amp;#x27;s details I&amp;#x27;m missing though!)</text></comment>
<story><title>CacheBleed: A Timing Attack on OpenSSL Constant Time RSA</title><url>https://ssrg.nicta.com.au/projects/TS/cachebleed/</url></story><parent_chain></parent_chain><comment><author>EwanG</author><text>Overview direct from the article - &amp;quot;CacheBleed is a side-channel attack that exploits information leaks through cache-bank conflicts in Intel processors. By detecting cache-bank conflicts via minute timing variations, we are able to recover information about victim processes running on the same machine. Our attack is able to recover both 2048-bit and 4096-bit RSA secret keys from OpenSSL 1.0.2f running on Intel Sandy Bridge processors after observing only 16,000 secret-key operations (decryption, signatures). This is despite the fact that OpenSSL&amp;#x27;s RSA implementation was carefully designed to be constant time in order to protect against cache-based (and other) side-channel attacks.&lt;p&gt;While the possibility of an attack based on cache-bank conflicts has long been speculated, this is the first practical demonstration of such an attack.&amp;quot;</text></comment>