The DOI matches its Crossref record; 28 of the 28 references it cites were found in a registry or an index.
Pseudo Constant Time Implementations of TLS Are Only Pseudo Secure
Abstract
Today, about 10% of TLS connections are still using CBC-mode cipher suites, despite a long history of attacks and the availability of better options (e.g. AES-GCM). In this work, we present three new types of attack against four popular fully patched implementations of TLS (Amazon's s2n, GnuTLS, mbed TLS and wolfSSL) which elected to use "pseudo constant time" countermeasures against the Lucky 13 attack on CBC-mode. Our attacks combine several variants of the PRIME+PROBE cache timing technique with a new extension of the original Lucky 13 attack. They apply in a cross-VM attack setting and are capable of recovering most of the plaintext whilst requiring only a moderate number of TLS connections. Along the way, we uncovered additional serious (but easy to patch) bugs in all four of the TLS implementations that we studied; in three cases, these bugs lead to Lucky 13 style attacks that can be mounted remotely with no access to a shared cache. Our work shows that adopting pseudo constant time countermeasures is not sufficient to attain real security in TLS implementations in CBC mode.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Citations
Cites
Cache Attacks and Countermeasures: The Case of AES
Osvik, D. A., Adi Shamir, Z., & Tromer, E. (2005) · Lecture notes in computer science · doi:10.1007/11605805_1 · Cited by 1,431
Last-Level Cache Side-Channel Attacks are Practical
Liu, F., Yarom, Y., Ge, Q., Heiser, G. A., & Lee, R. B.-L. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.43 · Cited by 1,036
FLUSH+RELOAD: a high resolution, low noise, L3 cache side-channel attack
Yarom, Y., & Falkner, K. E. K. (2013) · Cited by 977
Cross-VM side channels and their use to extract private keys
Zhang, Y., Juels, A., Reiter, M. K., & Ristenpart, T. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382230 · Cited by 791
Flush+Flush: A Fast and Stealthy Cache Attack
Gruss, D., Maurice, C., Wagner, K., & Mangard, S. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-40667-1_14 · Cited by 588
Cache Games -- Bringing Access-Based Cache Attacks on AES to Practice
Gullasch, D., Bangerter, E., & Krenn, S. (2011) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2011.22 · Cited by 547
Secrecy, authentication, and public key systems
Merkle, R. C. (1979) · Cited by 501
Lucky Thirteen: Breaking the TLS and DTLS Record Protocols
Fardan, N. J. A., & Paterson, K. G. (2013) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2013.42 · Cited by 364
Self-citationSecurity Flaws Induced by CBC Padding — Applications to SSL, IPSEC, WTLS...
Serge Vaudenay, B. (2002) · Lecture notes in computer science · doi:10.1007/3-540-46035-7_35 · Cited by 329
Password Interception in a SSL/TLS Channel
Canvel, B., Hiltgen, A. P., Serge Vaudenay, B., & Vuagnoux, M. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45146-4_34 · Cited by 182
Research works printed but not linked: 3
- Mehmet Sinan Inci , Berk Gülmezoglu , Gorka Irazoqui , Thomas Eisenbarth , and Berk Sunar . 2016. Cache Attacks Enable Bulk Key Recovery on the Cloud Cryptographic Hardware and Embedded Systems -- CHES 2016 (Lecture Notes in Computer Science), Benedikt Gierlichs and Axel Y . Poschmann (Eds.), Vol. Vol. 9813 . Springer , Heidelberg , 368--388. Mehmet Sinan Inci, Berk Gülmezoglu, Gorka Irazoqui, Thomas Eisenbarth, and Berk Sunar. 2016. Cache Attacks Enable Bulk Key Recovery on the Cloud Cryptographic Hardware and Embedded Systems -- CHES 2016 (Lecture Notes in Computer Science), Benedikt Gierlichs and Axel Y. Poschmann (Eds.), Vol. Vol. 9813. Springer, Heidelberg, 368--388.
- Paul Kocher , Jann Horn , Anders Fogh , , Daniel Genkin , Daniel Gruss , Werner Haas , Mike Hamburg , Moritz Lipp , Stefan Mangard , Thomas Prescher , Michael Schwarz , and Yuval Yarom . 2019 . Spectre Attacks: Exploiting Speculative Execution. In 40th IEEE Symposium on Security and Privacy (S&P'19) . Paul Kocher, Jann Horn, Anders Fogh, , Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. 2019. Spectre Attacks: Exploiting Speculative Execution. In 40th IEEE Symposium on Security and Privacy (S&P'19).
- Moritz Lipp , Michael Schwarz , Daniel Gruss , Thomas Prescher , Werner Haas , Anders Fogh , Jann Horn , Stefan Mangard , Paul Kocher , Daniel Genkin , Yuval Yarom , and Mike Hamburg . 2018 . Meltdown: Reading Kernel Memory from User Space . In 27th USENIX Security Symposium (USENIX Security 18) . Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. 2018. Meltdown: Reading Kernel Memory from User Space. In 27th USENIX Security Symposium (USENIX Security 18).
Cited by
Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd
Vanhoef, M., & Ronen, E. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00031 · Cited by 179
Self-citation
Metadata
- Authors
- Ronen, E., Paterson, K. G., & Shamir, A.
- Affiliations
- Weizmann Institute of Science (IL)
- Royal Holloway University of London (GB)
- Weizmann Institute of Science, Rechovot, Israel
- Venue
- Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2018-10-15
- Volume
- 2018
- Pages
- 1397-1414
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2891653310
- Cited by
- 21
- References
- 28
- Citations by year
- 2025: 2 · 2023: 4 · 2022: 1 · 2021: 2 · 2020: 6 · 2019: 6
- FWCI
- 1.42
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- IACR Cryptology ePrint Archive (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- TLS, CBC mode, side-channel attacks, wolfSSL
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Pseudo Constant Time Implementations of TLS Are Only Pseudo Secure. https://app.cochat.ai/papers/10.1145/3243734.3243775
- The paper
- Ronen, E., Paterson, K. G., & Shamir, A. (2018). Pseudo Constant Time Implementations of TLS Are Only Pseudo Secure. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. https://doi.org/10.1145/3243734.3243775
