Abstract:Cryptographic devices are vulnerable to side-channel attacks, which have attracted broad attention in the hardware security field. The side-channel analysis framework proposed at Eurocrypt 2009 has been widely adopted in academia, containing key elements such as points of interest, leakage models, distinguishers, and security metrics. This classical framework, however, is not intuitively compatible with recent micro-architectural attacks such as cache attacks, therefore, few attempts have been made to link them. In this paper, we extend the classical side-channel analysis framework and migrate its ideas to access-driven cache attacks. We find that cache attacks can be effectively incorporated into this framework. Specifically, we propose a leakage model called cache access pattern vector according to the cache timing leakage characteristics. Furthermore, we propose data preprocessing schemes such as noise reduction, dimensionality reduction, and vector expansion to implement efficient attacks. Subsequently, we proposed seven distinguishers in three categories: difference of means-based analysis, vector distance-based analysis, and mutual information-based analysis. Moreover, we attacked the last round of the AES fast software implementation algorithm based on the Chipyard platform. According to the experimental results, all proposed methods can successfully extract the key, and five of them are comparable to mainstream cache analysis in attack efficiency. Finally, we evaluate the five efficient distinguishers under three different cache micro-architectures using guessing entropy. Based on the experimental environment of this paper, vector distance-based distinguishers have the best attack efficiency, and the difference of mean-based analysis has the worst. Surprisingly, the most general mutual information-based attacks can achieve excellent medium results in a few attack rounds without the help of static analysis tools. Meanwhile, the experimental results demonstrate that cache micro-architecture directly impacts the attack effect, in which the smaller cache line size benefits the attacks, while the random replacement policy increases the noise and difficulty of the attacks.

MCA-Based Multi-Channel Fusion Attacks Against Cryptographic Implementations

Securing Channel State Information in Multiuser MIMO with Limited Feedback.

MDASCA: an enhanced algebraic side-channel attack for error tolerance and new leakage model exploitation

Adaptive Side-Channel Analysis Model and Its Applications to White-Box Block Cipher Implementations.

Exploiting the Incomplete Diffusion Feature: A Specialized Analytical Side-Channel Attack Against the Aes and Its Application to Microcontroller Implementations

MLMSA: Multi-Label Multi-Side-Channel-Information enabled Deep Learning Attacks on APUF Variants

Fusion is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detection

Side-channel Attack Using Word Embedding and Long Short Term Memories.

Secured Measurement Fusion Scheme Against Deceptive ECM Attack in Radar Network

A Unified and Fully Automated Framework for Wavelet-based Attacks on Random Delay

Extending the classical side-channel analysis framework to access-driven cache attacks

Improved Low-Entropy Masking Scheme For Led With Mitigation Against Correlation-Enhanced Collision Attacks

Frequency Domain Channel-Wise Attack to CNN Classifiers in Motor Imagery Brain-Computer Interfaces

Horizontal DPA Attacks against ECC: Impact of Implemented Field Multiplication Formula

Deep learning‐assisted and combined attack: a novel side‐channel attack

Magnifying Side-Channel Leakage of Lattice-Based Cryptosystems with Chosen Ciphertexts: The Case Study of Kyber

Analysis of Multiplicative Low Entropy Masking Schemes Against Correlation Power Attack

Enhanced Differential Cache Attacks on SM4 with Algebraic Analysis and Error-Tolerance

Timing Side-Channel Attacks and Countermeasures in CPU Microarchitectures

Side-Channel Information Leakage Analysis And Countermeasures In An Embedded Cpu Microarchitecture

Energy Efficient Obfuscation of Side-Channel Leakage for Preventing Side-Channel Attacks