Predicting Secret Keys Via Branch Prediction

This paper announces a new software side-channel attack — enabled by the branch prediction capability common to all modern highperformance CPUs. The penalty paid (extra clock cycles) for a mispredicted branch can be used for cryptanalysis of cryptographic primitives that employ a data-dependent program flow. Analogous to the recently described cache-based side-channel attacks our attacks also allow an unprivileged process to attack other processes running in parallel on the same processor, despite sophisticated partitioning methods such as memory protection, sandboxing or even virtualization. In this paper, we will discuss several such attacks for the example of RSA, and experimentally show their applicability to real systems, such as OpenSSL and Linux. Moreover, we will also demonstrate the strength of the branch prediction sidechannel attack by rendering the obvious countermeasure in this context (Montgomery Multiplication with dummy-reduction) as useless. Although the deeper cons...

• Type: Conference
• Year: 2007
• Where: CTRSA
• Authors: Onur Aciiçmez, Çetin Kaya Koç, Jean-Pierre Seifert
• Keywords: Branch Prediction, Cryptology, CTRSA 2007, Side-channel Attacks, Software Side-channel Attack