Skip to main content

TS

CacheBleed: A timing attack on OpenSSL constant time RSA

Authors

Yuval Yarom, Daniel Genkin and Nadia Heninger

University of Adelaide

Data61
CSIRO

University of Pennsylvania

University of Maryland

Abstract

The scatter-gather technique is a commonly implemented approach to prevent cache-based timing attacks. In this paper we show that scatter-gather is not constant time. We implement a cache timing attack against the scatter-gather implementation used in the modular exponentiation routine in OpenSSL version 1.0.2f. Our attack exploits cache-bank conflicts on the Sandy Bridge microarchitecture. We have tested the attack on an Intel Xeon E5-2430 processor. For 4096-bit RSA our attack can fully recover the private key after observing 16,000 decryptions.

BibTeX Entry

  @article{Yarom_GH_17,
    slides           = {http://ts.data61.csiro.au/publications/nicta_slides/9535.pdf},
    doi              = {10.1007/s13389-017-0152-y},
    journal          = {Journal of Cryptographic Engineering},
    author           = {Yarom, Yuval and Genkin, Daniel and Heninger, Nadia},
    number           = {2},
    month            = may,
    volume           = {7},
    year             = {2017},
    title            = {{CacheBleed}: A Timing Attack on {OpenSSL} Constant Time {RSA}},
    pages            = {99--112}
  }

Download