Implementation of cache attacks in practical scenarios and toolkit development

Abstract

The report describes the development of several software side-channel attacks which exploit cache vulnerabilities on Intel and ARM CPUs to break an AES (Advanced Encryption Standard) implementation. The cache vulnerabilities leak time-based information due to fetches from different areas of memory which can then be exploited to recover the full AES 128-bit keys. Theoretically, these side-channel attacks are easy to understand with existing literatures but are hard to implement in a practical scenario. In this project, the following side-channel attacks are developed: for Intel Central Processing Unit (CPU): (1) L1 Prime and Probe, (2) Last Level Core Prime and Probe, (3) Flush and Reload, (4) Evict and Reload and for ARM CPU: (5) Evict and Reload. These attacks are developed in C and illustrate a proof of concept of gathering the first nibble (i.e first 4 bits) of the AES key for each attack on an Ubuntu 18.04.3 LTS.