Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical

• The work targets an on-chip attack channel that remains available despite countermeasures aimed at many cache-based attacks.The ring connects CPU units, and extracting information through its contention is difficult because the signal is noisy and reflects spatially coarse-grained events.Source: §1 · p. 1
• Reverse engineering reveals ring-resource allocation and arbitration, including two independent lanes and priority for in-flight over new traffic.The authors formulate necessary and sufficient conditions for processes to contend; communicating in the same direction on overlapping ring segments alone is insufficient.Source: §1 · pp. 1–2
• 4.14 Mbps (518 KBps) is the covert-channel capacity achieved from a single thread without shared memory or shared access to an uncore structure.The authors report this as faster than prior channels not relying on shared memory and within the same order of magnitude as state-of-the-art channels that do rely on it.Source: §1 · p. 2
• The attacks extract key bits from vulnerable RSA and EdDSA implementations and infer keystroke timing with high accuracy.The key attack triggers cache misses, monitors ring contention, and uses a machine-learning classifier to denoise traces; keystrokes produce detectable contention spikes despite background noise.Source: §1 · p. 2

2 Background and Related Work

• LLC slices are shared across cores, while private-cache misses send loads through the ring to an LLC slice or memory controller.Each core shares its ring stop with one LLC slice, and ring traffic uses the shortest path to its destination.Source: §2 · p. 2

2.1 Microarchitectural Side Channels

• Microarchitectural channels are classified by resource and concurrency: eviction-based channels leave persistent state, while contention-based channels expose latency variation during victim execution.The paper’s attack is contention-based and uses a multicore leakage channel, with attacker and victim on separate cores.Source: §2.1 · p. 3

2.2 Side Channel Defenses

• Defenses include disabling shared resources, partitioning them, and erasing microarchitectural state across context switches.Examples include disabling SMT, partitioning the LLC with Intel CAT, and flushing CPU caches on context switches.Source: §2.2 · p. 3

3.1 Inferring the Ring Topology

• LLC load latency increases with ring distance, and an attacker can use latency to narrow an address’s possible slice to two, then triangulate from two cores without root access.The experiments found that both tested CPUs’ logical ring topologies match the linear topology.Source: §3.1 · p. 4

3.2 Understanding Contention on the Ring

• Ring contention requires sender traffic to share the receiver’s lane, direction, and overlapping segment and to enter upstream; targeting the same LLC slice also causes slice contention.Figure 3 distinguishes slice contention from ring contention; the latter occurs when sender traffic delays injection of receiver traffic onto the ring.Source: Figure 3 · p. 5, §3.2 · pp. 6–7
• Same-slice loads always contend; slice request-queue and bandwidth saturation explain the delays, while data-ring traffic causes more contention than request traffic, with the greatest contention across multiple rings.The shared slice port supplies at most 32 B/cycle, or half a cache line per cycle.Source: §3.2 · pp. 6–7
• Opposite-direction or non-overlapping traffic does not contend; ring stops can simultaneously service home-slice traffic with cross-ring traffic and opposite-direction cross-ring flows.The findings are consistent with two physical ring flows, one in each direction.Source: §3.2 · p. 6
• Each ring has two lanes keyed to destination clusters, and ring stops prioritize traffic already on-ring over new injections, so matching-lane upstream traffic delays receiver injection.For LLC-hit traffic, sender priority alone is not sufficient: contention also depends on whether sender and receiver traffic use the same lane.Source: §3.2 · p. 7
• On LLC misses, slices still receive requests and forward them to the system agent on the incoming request lane; the agent supplies data and global-observation messages directly to the requesting core.The authors measured a fixed 248±3 cycles while varying the requesting core, supporting direct service from the system agent.Source: §3.2 · pp. 7–8
• Misses also produce a slice-to-core acknowledgment and system-agent-to-slice data traffic; observed lane sharing for the latter depends on the destination agent type.The authors present the subsequent miss-transaction steps as an informed hypothesis.Source: §3.2 · p. 8
• LLC misses add contention cases because the system agent sends a separate data copy to the missing slice, using the lane also used for data traffic to a core in the opposite cluster.SA→slice traffic occurs separately from SA→core traffic, and contention from both flows together exceeds either flow alone.Source: §3.2 · p. 9
• Contention is not proportional to the overlapping segment’s length; multiple simultaneous senders can increase it by filling more ring slots.The amount depends on full “boxcars” passing receiver ring stops as they try to inject traffic; one observed pair of senders caused more contention than either alone.Source: §3.2 · p. 9
• Hardware prefetchers can amplify contention or create new contention cases by transferring additional cache lines and filling ring slots, potentially on multiple lanes.The paper leaves formal modeling of these additional patterns for future work.Source: §3.2 · p. 9
• The contention model is based on observations and hypotheses from the tested CPUs, and some explanations may be incorrect.The authors state that their goal is a useful model, which they use in later sections to build attacks.Source: §3.2 · p. 9
• A receiver can distinguish an idle sender from loads missing in private caches and served by a particular LLC slice, if it sets up expected contention.The slice an address maps to may also reveal information about its physical address; the necessary and sufficient contention conditions are given by Equations 1 and 2.Source: §3.2 · p. 9

4 Cross-core Covert Channel

• The sender transmits 1 by creating ring contention and 0 by idling; the receiver distinguishes them using mean load latency.Smaller mean latencies map to 0 and larger ones to 1.Source: §4 · pp. 9–10
• The implementation configures short receiver ring segments, sender traffic that contends on both flows, and enabled prefetchers to increase channel speed.The sender targets LLC hits, and the reported Coffee Lake trace shows distinguishable latency hills and valleys at a 3,000-cycle interval.Source: §4 · p. 10, Figure 5 · p. 10
• 4.14 Mbps channel capacity on Skylake and 3.35 Mbps on Coffee Lake; the authors report the former as the largest cross-core capacity without shared memory to date.The Coffee Lake result uses a 750-cycle transmission interval; the Skylake result uses 727 cycles.Source: §4 · p. 10, Figure 6 · p. 10
• Reported end-to-end capacity was measured without background noise; noise may reduce performance and require error-correction codes not included in the measurements.Source: §4 · p. 10

5 Cross-core Side Channels

• Victim memory accesses that contend with attacker loads increase measured latency, which can reveal secrets when the delays are attributable to victim execution.The threat model assumes SMT is off, multicore cache attacks are unavailable, and the attacker can run unprivileged code on the victim’s machine.Source: §5 · pp. 10–11

5.1 Side Channel Attack On Cryptographic Code

• A 1-valued key bit triggers E2 after E1, producing an additional contention peak; a 0 skips E2, allowing the attacker to distinguish the bit.The attack extends across iterations by interrupting and resuming the victim, with cache cleansing returning it to a cold-cache state.Source: §5.1 · p. 11
• The RSA proof of concept targets libgcrypt 1.5.2 square-and-multiply decryption, where multiplication runs only for 1-valued key bits.The reported classifier accuracy is 90% with prefetchers on and 86% with them off.Source: §5.1 · pp. 11–12
• The EdDSA target is libgcrypt 1.6.3 Curve25519 signing, where point doubling is unconditional and point addition runs only for 1-valued scalar bits.The reported classifier accuracy is 94% with prefetchers on and 90% with them off.Source: §5.1 · p. 12

5.2 Keystroke Timing Attacks

• Keystroke processing produces a distinguishable ring-contention pattern: across the first 100 typed characters, the attack had zero false negatives and zero false positives, with peaks within 1 ms.Results were similar for local-terminal typing and on Skylake; with more than four synthetic memory-load threads, keystrokes became almost indistinguishable from background noise.Source: §5.2 · p. 13
• The authors attribute keystroke latency peaks to ring contention: peaks were absent when timing L1 hits and were more pronounced on more-contended ring segments.They report this as their belief, supported by comparisons with measured contention latencies and different monitoring configurations.Source: §5.2 · p. 13

Attack Requirements

• The cryptographic attack requires cache cleansing on context switches, which major operating systems do not currently perform.The authors note cleansing may be deployed if temporal isolation is added to operating systems.Source: §6 · p. 13
• The proof of concept assumes preemptive scheduling; its practicality in restricted environments such as browsers remains unassessed.The paper says a real attack would need to implement such techniques and cites prior demonstrations in non-virtualized, virtualized, and SGX settings.Source: §6 · p. 13

Mitigations

• Constant-time programming should block the demonstrated RSA and EdDSA attacks, but hardware optimizations such as store elimination may undermine constant-time behavior.The paper says store elimination between private caches and the ring may make contention depend on cache-line contents.Source: §6 · p. 13
• Spatial partitioning with static arbitration could prevent cross-domain ring contention, while cluster-based placement must also account for LLC misses crossing clusters.The paper notes that these hardware approaches would still need to mitigate slice contention.Source: §6 · p. 13
• Performance counters could detect bursts of receiver loads to one LLC slice, but such anomaly detection would need low false-positive rates.The proposed monitoring applies because the receiver repeatedly misses in private caches and loads from a target LLC slice.Source: §6 · p. 13

Applicability to Other CPUs

• The attacks appear portable to ring CPUs, as the authors replicated their methodology on Xeon Broadwell, but mesh and AMD interconnects remain open questions.The paper says its contention-modeling techniques can also be applied to other platforms.Source: §6 · p. 14

7 Conclusion

• Reverse engineering the ring protocols reveals conditions under which two processes incur ring contention.These findings underpin the demonstrated covert channel and side-channel attacks.Source: §7 · p. 14
• The ring-based cross-core covert channel reaches over 4 Mbps, the largest reported for cross-core channels not relying on shared memory.Source: §7 · p. 14
• Temporal trends in ring contention leak key bits from vulnerable EdDSA and RSA implementations and the timing of a user's keystrokes.Source: §7 · p. 14

A.1 Reverse Engineering

• Figure 9 reports Skylake load latency across core, LLC-slice, and cache-set combinations; latency grows when loads travel farther on the ring.Source: Figure 9 · p. 17, §A.1 · p. 17
• Figure 10 shows receiver load latency as a sender transmits zeros and ones on Skylake with a 4,000-cycle interval and the stated core-slice configuration.Source: Figure 10 · p. 17
• Figure 11 reports raw bandwidth, error probability, and channel capacity for the same Skylake configuration as Figure 10.Source: Figure 11 · p. 17
• For core 0 loading from slice 0, odd cache sets have lower latency than even sets, but this parity effect does not affect the contention model.The authors hypothesize that the behavior may reflect LLC cache banking within individual slices.Source: §A.1 · p. 17
• Figure 12 maps contention for an LLC-hit receiver and LLC-miss sender by core and LLC slice; stars mark slice contention and darker gray marks greater ring contention.Source: §A.1 · p. 17, Figure 12 · p. 18

A.2 Covert Channel

• On the Skylake machine, Figure 10 reports a sample trace in which the sender transmits ones as peaks and zeros as valleys at a 4,000-cycle interval, and the signals are visibly distinguishable.Source: §A.2 · p. 18
• 4.14 Mbps (518 KBps) is the maximum Skylake channel capacity, reached with a 727-cycle transmission interval.Source: §A.2 · p. 18

Attack on Cryptographic Code

• 95% EdDSA and 92% EdDSA accuracy with prefetchers on and off, respectively, were achieved on Skylake; RSA accuracy was 90% with prefetchers on and 87% off.These results use Rc = 1, Rs = 0, and Sc = 2.Source: §A.3 · p. 19

Cache Cleansing

• L1/L2-only cleansing used eviction sets for data caches and jump instructions over a 32 KB region for instruction-cache lines, but its replacement-policy assumptions may make it incomplete.The authors note that current hardware lacks an instruction to reliably remove lines from L1d, L1i, and L2 only.Source: §A.3 · p. 19

Attack on Cryptographic Code

• 93% RSA and 96% EdDSA accuracy on Coffee Lake show that distinguishable contention patterns reveal secret bits when only L1/L2 are cleansed.The victims' LLC hits shorten iterations, but the patterns remain recognizable.Source: §A.3 · p. 19

Keystroke Timing Attack

• With Coffee Lake background noise, keystrokes remained distinguishable at N = 1 and N = 2, became harder to identify at N > 2, and nearly indistinguishable at N > 4.On Skylake, keystrokes remained easily distinguishable for N ≤ 2 and became harder at N = 3.Source: §A.3 · p. 19, Figure 15 · p. 20
• Physical-keyboard keystrokes on a local Coffee Lake tty remained distinguishable, though their contention patterns differed from SSH typing.The tty case was harder to attack than pty; the attack also worked on pty, and results were similar on Skylake and with background noise.Source: §A.3 · pp. 19–20, Figure 17 · p. 20

A.4 Results from a Server-class CPU

• The 12-core Broadwell Xeon had a one-and-a-half-ring topology, unlike the linear client-CPU topology, but retained the same distributed boxcar arbitration policy.The topology matches the high-level diagram for a Medium Core Count configuration.Source: §A.4 · p. 20, Figure 19 · p. 20
• Broadwell configurations successfully replicated the covert channel, cryptographic side-channel attack, and keystroke-timing attack.The authors report successful attack configurations including Rc = 10, Rs = 7, and Sc = 11 for cryptographic code.Source: §A.4 · p. 20
• The authors leave exhaustive reverse engineering of server-class ring-agent clustering rules and corresponding equations for future work.Under some receiver configurations, traces also shifted by constant offsets, hypothesized to result from Uncore Frequency Scaling.Source: §A.4 · p. 20