Re: Timing attack on general purpose processor
From: David Wagner (daw_at_taverner.cs.berkeley.edu)
Date: 06/02/05
- Next message: Markus Jansson: "Article: MD5 breaks on laptop computer in 15 minutes"
- Previous message: Thomas Pornin: "Re: Determinstic OpenSSL signature"
- In reply to: cedric.lauradoux_at_inria.fr: "Re: Timing attack on general purpose processor"
- Next in thread: none: "Re: Timing attack on general purpose processor"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 2 Jun 2005 19:29:51 +0000 (UTC)
>The main difference between warmup and prefetch technique is that we
>insert some prefetch in the crypto loop. [..]
>Prefetch try and most of the time succeed to hide
>memory latency. When you made several prefetchs instructions you hide the
>access to many cache lined by the latency of only one. In fact prefecth
>just tell the processor that he has to load several data into cache (on
>x86 you can tell if it must be put into L1 or L2 or L3). In fact prefetch
>is going to improve the performance of the AES and the timing attack is
>going to be harder.
If I understand your suggestion, it is that you not only fetch the
memory address that you want to read from (i.e., the one you need for
your table lookup), but also one or two other memory addresses that you
don't care about (determined how??). But if I understand correctly, the
memory access pattern -- and the cache usage pattern -- is still
key-dependent. If you assume that an attacker on the same machine
can probe the cache (as in the hyperthreading attack), then it seems
that all this does is reduce the S/N ratio -- so all it means to the
attacker is that he has to average over a larger number of samples to
make the Signal stand out from the Noise. Is this correct?
It seems to me that more analysis is needed before we can conclude
whether this will help. I don't see why this prevents the attack
(as opposed to increasing its workfactor by some unknown constant).
- Next message: Markus Jansson: "Article: MD5 breaks on laptop computer in 15 minutes"
- Previous message: Thomas Pornin: "Re: Determinstic OpenSSL signature"
- In reply to: cedric.lauradoux_at_inria.fr: "Re: Timing attack on general purpose processor"
- Next in thread: none: "Re: Timing attack on general purpose processor"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
