PaperlayerView exact revision on arXiv

Source-linked AI summary

CacheZoom: How SGX Amplifies The Power of Cache Attacks

Ahmad Moghimi, Gorka Irazoqui, Thomas Eisenbarth

arXiv:1703.06986v2cs.CR

TL;DR

SGX protects enclave memory from a malicious OS but does not cover cache side channels, leaving secret-dependent accesses observable. CacheZoom combines L1 Prime+Probe with OS-level timing control to track enclave memory accesses and recover AES keys, including from implementations using prefetching. The tool recovers T-table AES keys with as few as 10 observations, while S-box recovery requires hundreds of observations; the authors conclude that security-critical code needs constant execution flows and secret-independent memory accesses.

  • Problem

    SGX excludes side-channel attacks from its threat scope, leaving the security of enclave computations against cache observation unresolved.

  • Method

    CacheZoom combines an L1 cache Prime+Probe attack with OS modifications that interrupt SGX enclaves at high frequency to collect fine-grained memory-access traces.

  • Results

    CacheZoom recovers key bits from major software AES implementations, including prefetching-based implementations, with T-table keys recoverable from as few as 10 observations.

  • Takeaways & Limitations

    CacheZoom provides evidence that security-critical code needs constant execution flows and secret-independent memory accesses.

  • Takeaways & Limitations

    Out-of-order execution prevents reliable separation of accesses for different byte positions, and separating accesses from different rounds can be challenging.

Abstract

from arXiv · show

In modern computing environments, hardware resources are commonly shared, and parallel computation is widely used. Parallel tasks can cause privacy and security problems if proper isolation is not enforced. Intel proposed SGX to create a trusted execution environment within the processor. SGX relies on the hardware, and claims runtime protection even if the OS and other software components are malicious. However, SGX disregards side-channel attacks. We introduce a powerful cache side-channel attack that provides system adversaries a high resolution channel. Our attack tool named CacheZoom is able to virtually track all memory accesses of SGX enclaves with high spatial and temporal precision. As proof of concept, we demonstrate AES key recovery attacks on commonly used implementations including those that were believed to be resistant in previous scenarios. Our results show that SGX cannot protect critical data sensitive computations, and efficient AES key recovery is possible in a practical environment. In contrast to previous works which require hundreds of measurements, this is the first cache side-channel attack on a real system that can recover AES keys with a minimal number of measurements. We can successfully recover AES keys from T-Table based implementations with as few as ten measurements.

1 Motivation

Shared hardware and expanding cloud environments make isolation difficult, while SGX does not address cache side channels. CacheZoom exploits SGX attacker capabilities to obtain high-resolution traces and recover AES keys, including from implementations with purported countermeasures.

  • 1 Motivation: Cloud systems run services from different providers on shared hardware, expanding the security and privacy risks of concurrent computation.The operating system, cloud provider, and hypervisor may all become part of the trusted computing base.
  • 1 Motivation: SGX protects enclave code and data through hardware-backed encryption, authentication, and isolation, but its design does not include side-channel attacks.Enclave data is decrypted as it moves into processor caches, where hardware utilization remains observable.
  • 1 Motivation: Cache attacks offer fine spatial and temporal resolution, but conventional LLC monitoring undersamples AES executions because a Prime+Probe cycle takes about 2000 cycles.Synchronized attacks therefore yield at best one observation per encryption outside OS-adversarial scenarios.
  • 1.1 Our Contribution: CacheZoom interrupts enclaves every few memory accesses and applies L1 Prime+Probe, using a compromised OS to collect high-resolution memory-access information.Scheduling the victim and attacker on the same core preserves applicability despite the use of core-private resources.
  • 1.1 Our Contribution: CacheZoom recovers AES keys with fewer traces than previous attacks and targets implementations considered resistant against cache attacks.The demonstrated countermeasures include prefetching and S-box implementations; prefetching can ease trace retrieval.

2 Background

SGX creates hardware-isolated enclaves while treating the OS and other agents as potentially malicious. Cache side channels remain available because encrypted enclave pages are decrypted in caches, enabling fine-grained observation of key-dependent accesses.

  • 2 Background: SGX executes software in isolated enclaves intended to protect it from other components, including operating systems, on the same hardware.The enclave's authenticity, integrity, and confidentiality are provided and measured by hardware.
  • 2 Background: SGX encrypts enclave pages in DRAM and decrypts them when the CPU processes them, including during movement into caches.The model trusts the hardware while treating other agents as potentially malicious.
  • 2.2 Microarchitectural Attacks in SGX: SGX documentation excludes side-channel attacks from its design threat scope, although caches remain concurrently usable by malicious OSs and enclaves.A malicious OS can interrupt enclave execution after a small number of memory accesses and inspect hardware utilization.
  • 2 Background: Caches expose 64-byte utilization granularity and can reveal information from any memory access, unlike page faults and branch-prediction observations.This makes cache attacks particularly informative for secret-dependent computation.
  • 2 Background: Prime+Probe primes cache sets, observes victim-driven evictions, and probes access times to infer which sets the victim used.These inferred sets can support key recovery when memory accesses depend on secret values.

3 Related Work

Prior microarchitectural attacks use timing and cache behavior to infer secrets across systems and virtual machines. SGX introduces a stronger OS-adversary capability because the OS can interrupt enclaves with very fine temporal control.

  • 3 Related Work: Timing side channels have been used to recover information about private keys and break cryptographic operations such as Diffie-Hellman and RSA.Microarchitectural timing attacks form the broader context for cache-based attacks.
  • 3 Related Work: Shared-LLC attacks expanded cache side channels across cores and virtual machines, while Flush+Reload requires shared memory and memory deduplication.Prime+Probe avoids the shared-memory requirement but historically faced core-private-cache limitations.
  • 3 Related Work: Prior SGX analyses include side-channel-resistant TCB proposals, but the proposed processor changes are significant; ARM TrustZone is also vulnerable to cache side channels.Control-channel attacks use adversarially induced page faults to obtain information from target applications.

4 Creating a High-resolution Side Channel on Intel SGX

CacheZoom builds a high-resolution SGX side channel by combining a compromised OS, isolated execution resources, and frequent L1 cache measurements. On a Skylake system, it reduces noise sufficiently to observe most cache-set activity, though four sets are unusable.

  • 4 Creating a High-resolution Side Channel on Intel SGX: The attacker assumes Linux root access, enabling kernel-module installation, boot configuration, binary inspection, and identification of table offsets.The attacker can observe the static binary but does not necessarily know the enclave's secret-dependent runtime behavior.
  • 4 Creating a High-resolution Side Channel on Intel SGX: CacheZoom isolates attacker and enclave execution, interrupts the enclave frequently, and monitors the L1D cache with Prime+Probe.The L1 cache is virtually addressed, so the offset from a page boundary identifies the accessed set.
  • 4 Creating a High-resolution Side Channel on Intel SGX: The modified interrupt handler probes all 64 L1D sets, primes them for the next execution unit, and stores each observation in a separate buffer.This design reduces the number of victim accesses between measurements.
  • 4 Creating a High-resolution Side Channel on Intel SGX: The setup uses a Skylake i7-6500U laptop with two hyper-threaded physical cores and a 64-set, 8-way associative L1 cache.Frequency scaling and hyperthreading are controlled to make cycle measurements more stable.
  • 4.4 Testing the Performance of CacheZoom: 4 of 64 cache sets are unusable because context-switch accesses completely fill them; the remaining sets have 0 or fewer than 8 unwanted accesses.The experiment used 50000 samples to assess eviction-based resolution, and consistent per-set noise enables threshold-based removal.

5 Attack on AES

The paper examines cache attacks against several AES implementation styles, including approaches designed to reduce leakage or memory usage. It explains how cache-line resolution, table organization, prefetching, and SGX's timing capabilities shape the attacker’s observations.

  • AES implementations: AES cache leakage primarily arises from secret-dependent table lookups during SubBytes.These accesses expose information through cache observations.
  • AES implementations: The S-box implementation uses a 256-entry, 8-bit substitution table and performs 160 table accesses during AES-128 encryption.It performs 16 accesses per round.
  • AES implementations: The 4 T-table implementation combines MixColumns and SubBytes in four 256-entry tables, reducing encryption time at the cost of larger tables.The four tables contain rotated versions of the same bytes.
  • AES implementations: The Large T-table implementation stores the equivalent data in one 256-entry table whose 64-bit entries contain two copies of 32-bit values.Different byte offsets provide the values associated with the four regular T-tables.
  • Cache observations: 64-byte cache lines limit the S-box to four cache lines, allowing at most two bits of information per separately observed table access.Large T-tables occupy 32 cache lines, and separately observed accesses can reveal five bits per access.
  • Countermeasures: Prefetching loads substitution tables before use, but SGX's interrupt capability can provide enough temporal resolution to inspect accesses despite this countermeasure.The paper analyzes prefetching under an attacker-controlled operating system that can interrupt AES after small numbers of accesses.

6 CacheZooming SGX-based AES

CacheZoom recovers fine-grained AES memory-access information inside SGX enclaves, despite noise, out-of-order execution, and countermeasures such as prefetching. The resulting traces enable key recovery for T-table and S-box implementations with different measurement requirements.

  • T-table Implementations: CacheZoom assumes enclave binary access and known plaintext or ciphertext bytes, then targets the first two AES rounds to recover T-table keys.The binary reveals substitution-table offsets, but the encryption key remains unknown.
  • T-table Implementations: Noise, parallel memory accesses, and round separation complicate attribution of observed accesses to the enclave’s actual memory operations.Interrupting and evicting the L1D cache can repeatedly reload cache lines while target reads complete.
  • T-table Implementations: 55% of recovered 4 T-table accesses were true accesses, compared with 75% for the single Large T-table implementation.Among true accesses, 77% were ordered for 4 T-table and 67% for Large T-table; missed true accesses were 56% and 12%, respectively.
  • T-table Implementations: Roughly 20 traces recovered the entire key with 90% probability without access ordering in both tested T-table implementations.The result is reported for both the 4 T-table and single T-table implementations.
  • T-table Implementations: Using approximate access order reduced the requirement to around 15 traces for 4 T-table and 12 traces for single Large T-table recovery at 90% probability.The method scores potentially misordered accesses rather than discarding them automatically.
  • Cache Prefetching: Prefetching did not prevent CacheZoom and instead distinguished AES rounds, facilitating further automation of key recovery.The prefetch pattern was clearly visible in the memory footprint and helped identify round boundaries.
  • S-Box Implementation: For S-box implementations, CacheZoom distinguishes round-level accesses but cannot reliably separate byte positions, so the attack correlates cache-line access counts with predicted accesses.The correlation model maps each key hypothesis and ciphertext to one of four S-box cache lines.
  • S-Box Implementation: 500 traces recovered 64 key bits and 1500 traces reliably recovered 80 key bits, while full S-box key recovery remained challenging.Thousands of observations easily recovered 12 of 16 key bytes; remaining bytes could be brute-forced or attacked through the second-last round.

7 Conclusion

CacheZoom combines L1 cache Prime+Probe with OS modifications to analyze SGX enclave memory accesses at high resolution. It recovers key information from major software AES implementations, including prefetching-based countermeasures, and shows that SGX AES code must use constant memory accesses.

  • CacheZoom combines L1 cache Prime+Probe with OS modifications that greatly enhance temporal resolution.The approach analyzes memory accesses of SGX enclaves using a high-resolution side channel.
  • Keys can be recovered from T-table implementations with as few as 10 observations.For S-box implementations, hundreds of observations provide sufficient key information for full recovery.
  • CacheZoom recovers key bits from all major software AES implementations, including implementations using prefetches as a cache-attack countermeasure.Prefetching can benefit the adversary by helping identify and separate accesses from different rounds.
  • SGX AES implementations must use constant memory accesses to avoid microarchitectural leakage.Suggested implementation styles include bit-sliced, vectorized-instruction-based, or all-cache-line lookup implementations.
Loading 1703.06986v2…