Microwalk: A framework for finding side channels in binaries
Open accessAbstract
Microarchitectural side channels expose unprotected software to information leakage attacks where a software adversary is able to track runtime behavior of a benign process and steal secrets such as cryptographic keys. As suggested by incremental software patches for the RSA algorithm against variants of side-channel attacks within different versions of cryptographic libraries, protecting security-critical algorithms against side channels is an intricate task. Software protections avoid leakages by operating in constant time with a uniform resource usage pattern independent of the processed secret. In this respect, automated testing and verification of software binaries for leakage-free behavior is of importance, particularly when the source code is not available. In this work, we propose a novel technique based on Dynamic Binary Instrumentation and Mutual Information Analysis to efficiently locate and quantify memory based and control-flow based microarchitectural leakages. We develop a software framework named MicroWalk for side-channel analysis of binaries which can be extended to support new classes of leakage. For the first time, by utilizing MicroWalk, we perform rigorous leakage analysis of two widely-used closed-source cryptographic libraries: Intel IPP and Microsoft CNG. We analyze 15 different cryptographic implementations consisting of 112 million instructions in about 105 minutes of CPU time. By locating previously unknown leakages in hardened implementations, our results suggest that MicroWalk can efficiently find microarchitectural leakages in software binaries.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems
Kocher, P. C. (1996) · Lecture notes in computer science · doi:10.1007/3-540-68697-5_9 · Cited by 4,446 · see citing works
THE GENERALIZATION OF ‘STUDENT'S’ PROBLEM WHEN SEVERAL DIFFERENT POPULATION VARLANCES ARE INVOLVED
WELCH, B. L. (1947) · Biometrika · doi:10.1093/biomet/34.1-2.28 · Cited by 4,135 · see citing works
Luk, C.-K., Cohn, R. S., Muth, R., et al. (2005) · ACM SIGPLAN Notices · doi:10.1145/1064978.1065034 · Cited by 3,203 · see citing works
Luk, C.-K., Cohn, R. S., Muth, R., et al. (2005) · Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation · doi:10.1145/1065010.1065034 · Cited by 2,309 · see citing works
The Elliptic Curve Digital Signature Algorithm (ECDSA)
Johnson, D. B., Menezes, A., & Vanstone, S. A. (2001) · International Journal of Information Security · doi:10.1007/s102070100002 · Cited by 2,254 · see citing works
The Generalization of `Student's' Problem when Several Different Population Variances are Involved
Welch, B. L. (1947) · Biometrika · doi:10.2307/2332510 · Cited by 1,946 · see citing works
Spectre Attacks: Exploiting Speculative Execution
Kocher, P. C., Horn, J., Fogh, A., Genkin, D., Gruss, D., Haas, W., Hamburg, M., Lipp, M., Mangard, S., Prescher, T., et al. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00002 · Cited by 1,847 · see citing works
Cache Attacks and Countermeasures: The Case of AES
Osvik, D. A., Shamir, A., & Tromer, E. (2005) · Lecture notes in computer science · doi:10.1007/11605805_1 · Cited by 1,362 · see citing works
Last-Level Cache Side-Channel Attacks are Practical
Liu, F., Yarom, Y., Ge, Q., Heiser, G. A., & Lee, R. B.-L. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.43 · Cited by 1,036 · see citing works
A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks
Standaert, F., Malkin, T., & Yung, M. M. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-01001-9_26 · Cited by 936 · see citing works
Remote timing attacks are practical
Brumley, D., & Boneh, D. (2005) · Computer Networks · doi:10.1016/j.comnet.2005.01.010 · Cited by 875 · see citing works
Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems
Xu, Y., Cui, W., & Peinado, M. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.45 · Cited by 725 · see citing works
Stefanov, E., van Dijk, M., Shi, E., et al. (2013) · doi:10.1145/2508859.2516660 · Cited by 701 · see citing works
Gierlichs, B., Batina, L., Tuyls, P., & Bart Preneel, A. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-85053-3_27 · Cited by 639 · see citing works
Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS #1
Bleichenbacher, D. (1998) · Lecture notes in computer science · doi:10.1007/bfb0055716 · Cited by 589 · see citing works
Power Analysis Attacks: Revealing the Secrets of Smart Cards (Advances in Information Security)
Mangard, S., Oswald, E., & Popp, T. (2007) · Springer eBooks · Cited by 583 · see citing works
On the Foundations of Quantitative Information Flow
Smith, G. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-00596-1_21 · Cited by 571 · see citing works
Advances in Cryptology – EUROCRYPT 2010
(2010) · Lecture notes in computer science · doi:10.1007/978-3-642-13190-5 · Cited by 504 · see citing works
Information theory with applications
Guiaşu, S., Sakuragui, C. M., & Valadares, R. T. (1977) · Medical Entomology and Zoology · Cited by 453 · see citing works
Sanctum: Minimal Hardware Extensions for Strong Software Isolation
Costan, V. V., Lebedev, I. A., & Devadas, S. (2016) · Cited by 379 · see citing works
CATalyst: Defeating last-level cache side channel attacks in cloud computing
Liu, F., Ge, Q., Yarom, Y., et al. (2016) · Proceedings - International Symposium on High-Performance Computer Architecture/Proceedings · doi:10.1109/hpca.2016.7446082 · Cited by 374 · see citing works
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware
Ge, Q., Yarom, Y., Cock, D., & Heiser, G. (2016) · Journal of Cryptographic Engineering · doi:10.1007/s13389-016-0141-6 · Cited by 369 · see citing works
Irazoqui, G., Eisenbarth, T., & Sunar, B. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.42 · Cited by 338 · see citing works
Self-citationCache Template Attacks: Automating Attacks On Inclusive Last-Level Caches
Gruss, D., Spreitzer, R., & Mangard, S. (2015) · INFM-OAR (INFN Catania) · doi:10.5281/zenodo.55454 · Cited by 323 · see citing works
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX
Wang, W., Chen, G., Pan, X., Zhang, Y., Wang, X., Bindschaedler, V., Tang, H., & Gunter, C. A. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134038 · Cited by 320 · see citing works
Predicting Secret Keys Via Branch Prediction
Acıiçmez, O., Koç, Ç. K., & Seifert, J. (2006) · Lecture notes in computer science · doi:10.1007/11967668_15 · Cited by 309 · see citing works
Armageddon: Cache Attacks On Mobile Devices
Lipp, M., Gruss, D., Spreitzer, R., Maurice, C., & Mangard, S. (2016) · Zenodo (CERN European Organization for Nuclear Research) · doi:10.5281/zenodo.59889 · Cited by 297 · see citing works
Boneh, D. (2006) · Springer eBooks · doi:10.1007/0-387-23483-7_114 · Cited by 295 · see citing works
Balakrishnan, G., & Reps, T. (2010) · ACM Transactions on Programming Languages and Systems · doi:10.1145/1749608.1749612 · Cited by 287 · see citing works
On the power of simple branch prediction analysis
Acıiçmez, O., Koç, Ç. K., & Seifert, J. (2007) · ACM Symposium on Information, Computer and Communications Security · doi:10.1145/1229285.1266999 · Cited by 256 · see citing works
CacheZoom: How SGX Amplifies the Power of Cache Attacks
Moghimi, A., Irazoqui, G., & Eisenbarth, T. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-66787-4_4 · Cited by 237 · see citing works
Self-citationCloudRadar: A Real-Time Side-Channel Attack Detection System in Clouds
Zhang, T., Zhang, Y., & Lee, R. B. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-45719-2_6 · Cited by 236 · see citing works
A new signature scheme based on the DSA giving message recovery
Nyberg, K., & Rueppel, R. A. (1993) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/168588.168595 · Cited by 221 · see citing works
CacheBleed: a timing attack on OpenSSL constant-time RSA
Yarom, Y., Genkin, D., & Heninger, N. (2017) · Journal of Cryptographic Engineering · doi:10.1007/s13389-017-0152-y · Cited by 210 · see citing works
Telling your secrets without page faults: stealthy page table-based attacks on enclaved execution
Bulck, J. V., Weichbrodt, N., Kapitza, R., et al. (2017) · Lirias · Cited by 183 · see citing works
Raccoon: closing digital side-channels through obfuscated execution
Rane, A., Lin, C., & Tiwari, M. (2015) · Cited by 182 · see citing works
Dynamic binary analysis and instrumentation
Nethercote, N. (2021) · CL Technical Reports · doi:10.48456/tr-606 · Cited by 171 · see citing works
New Results on Instruction Cache Attacks
Acıiçmez, O., Brumley, B. B., & Grabher, P. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-15031-9_8 · Cited by 168 · see citing works
“Ooh Aah... Just a Little Bit” : A Small Amount of Side Channel Can Go a Long Way
Benger, N., van de Pol, J., Smart, N. P., & Yarom, Y. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-44709-3_5 · Cited by 159 · see citing works
Coron, J.-S., Kocher, P. C., & Naccache, D. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45472-1_12 · Cited by 158 · see citing works
Stealing Keys from PCs Using a Radio: Cheap Electromagnetic Attacks on Windowed Exponentiation
Genkin, D., Pachmanov, L., Pipman, I., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48324-4_11 · Cited by 153 · see citing works
Doychev, G., Köpf, B., Mauborgne, L., & Reineke, J. (2015) · ACM Transactions on Information and System Security · doi:10.1145/2756550 · Cited by 150 · see citing works
Verifying constant-time implementations
Almeida, J. B., Barbosa, M., Barthe, G., et al. (2016) · Portuguese National Funding Agency for Science, Research and Technology (RCAAP Project by FCT) · Cited by 141 · see citing works
Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack.Preprint
Yarom, Y., & Benger, N. (2014) · IACR Cryptology ePrint Archive · Cited by 139 · see citing works
System-level Non-interference for Constant-time Cryptography
Barthe, G., Betarte, G., Campo, J. D., et al. (2014) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2660267.2660283 · Cited by 128 · see citing works
ARMageddon: Cache Attacks on Mobile DevicesPreprint
Lipp, M., Gruss, D., Spreitzer, R., Maurice, C., & Mangard, S. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1511.04897 · Cited by 125 · see citing works
Automatic Quantification of Cache Side-Channels
Köpf, B., Mauborgne, L., & Ochoa, M. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-31424-7_40 · Cited by 110 · see citing works
CacheAudit: A Tool for the Static Analysis of Cache Side Channels.
Doychev, G., Feld, D., Köpf, B., Mauborgne, L., & Reineke, J. (2013) · Cited by 109 · see citing works
Multi-run Side-Channel Analysis Using Symbolic Execution and Max-SMT
Păsăreanu, C. S., Phan, Q.-S., & Malacaria, P. (2016) · Proceedings - Computer Security Foundations Workshop/Proceedings · doi:10.1109/csf.2016.34 · Cited by 96 · see citing works
An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries
Andriesse, D., Chen, X., van der Veen, V., et al. (2016) · VU Research Portal · Cited by 87 · see citing works
Vale: Verifying High-Performance Cryptographic Assembly Code
Bond, B., Hawblitzel, C., Kapritsos, M., et al. (2017) · USENIX Security Symposium · Cited by 83 · see citing works
Multiple-Differential Side-Channel Collision Attacks on AES
Bogdanov, A. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-85053-3_3 · Cited by 81 · see citing works
Finding Software Vulnerabilities by Smart Fuzzing
Bekrar, S., Bekrar, C., Groz, R., et al. (2011) · IEEE International Conference on Software Testing, Verification and Validation (ICST) · doi:10.1109/icst.2011.48 · Cited by 81 · see citing works
Briongos, S., Irazoqui, G., Malagón, P., et al. (2018) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3176258.3176320 · Cited by 80 · see citing works
Dude, is my code constant time?
Reparaz, O., Balasch, J., & Verbauwhede, I. M. R. (2017) · Design, Automation, and Test in Europe · doi:10.23919/date.2017.7927267 · Cited by 74 · see citing works
Differential Cache-Collision Timing Attacks on AES with Applications to Embedded CPUs
Bogdanov, A., Eisenbarth, T., Paar, C., & Wienecke, M. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-11925-5_17 · Cited by 67 · see citing works
Self-citation"Make Sure DSA Signing Exponentiations Really are Constant-Time"
García, C. P., Brumley, B. B., & Yarom, Y. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978420 · Cited by 67 · see citing works
MemJam: A False Dependency Attack Against Constant-Time Crypto Implementations in SGX
Moghimi, D., Eisenbarth, T., & Sunar, B. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-76953-0_2 · Cited by 65 · see citing works
Self-citationPractical Keystroke Timing Attacks in Sandboxed JavaScript
Lipp, M., Gruss, D., Schwarz, M., et al. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66399-9_11 · Cited by 63 · see citing works
Cryptographic Hardware and Embedded Systems – CHES 2016
Dugardin, M., Guilley, S., Danger, J., et al. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53140-2 · Cited by 62 · see citing works
CacheD: Identifying Cache-Based Timing Channels in Production Software
Wang, S., Wang, P., Xiao, L., et al. (2017) · Rare & Special e-Zone (The Hong Kong University of Science and Technology) · Cited by 60 · see citing works
Xiao, Y., Li, M., Chen, S., & Zhang, Y. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134016 · Cited by 57 · see citing works
Rigorous analysis of software countermeasures against cache attacks
Doychev, G., & Köpf, B. (2017) · Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation · doi:10.1145/3062341.3062388 · Cited by 54 · see citing works
The Discrete Logarithm Problem
Schoof, R. (2016) · Springer eBooks · doi:10.1007/978-3-319-32162-2_12 · Cited by 53 · see citing works
PerfWeb: How to Violate Web Privacy with Hardware Performance Events
Gülmezoğlu, B., Zankl, A., Eisenbarth, T., et al. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66399-9_5 · Cited by 53 · see citing works
Self-citationWhat You Get is What You C: Controlling Side Effects in Mainstream C Compilers
Simon, L. J., Chisnall, D., & Anderson, R. (2018) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp.2018.00009 · Cited by 52 · see citing works
Kayaalp, M., Khasawneh, K. N., Esfeden, H. A., et al. (2017) · Proceedings - ACM IEEE Design Automation Conference · doi:10.1145/3061639.3062313 · Cited by 51 · see citing works
Formal verification of side-channel countermeasures using self-composition
Almeida, J. B., Barbosa, M., Pinto, J. S., & Vieira, B. (2011) · Science of Computer Programming · doi:10.1016/j.scico.2011.10.008 · Cited by 49 · see citing works
FaCT: A Flexible, Constant-Time Programming Language
Cauligi, S., Soeller, G., Brown, F., Johannesmeyer, B., Huang, Y., Jhala, R., & Stefan, D. (2017) · IEEE Cybersecurity Development (SecDev) · doi:10.1109/secdev.2017.24 · Cited by 47 · see citing works
CacheQuote: Efficiently Recovering Long-term Secrets of SGX EPID via Cache Attacks
Dall, F., Micheli, G. D., Eisenbarth, T., et al. (2018) · IACR Transactions on Cryptographic Hardware and Embedded Systems · doi:10.46586/tches.v2018.i2.171-191 · Cited by 47 · see citing works
Self-citationNew models of cache architectures characterizing information leakage from cache side channels
Zhang, T., & Lee, R. B.-L. (2014) · Annual Computer Security Applications Conference · doi:10.1145/2664243.2664273 · Cited by 45 · see citing works
Accelerating AES with Vector Permute Instructions
Hamburg, M. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04138-9_2 · Cited by 43 · see citing works
McNally, R., Yiu, K., Grove, D. A., et al. (2012) · Cited by 42 · see citing works
Kaufmann, T., Pelletier, H., Vaudenay, S., et al. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-48965-0_36 · Cited by 42 · see citing works
Automatic Application of Power Analysis Countermeasures
Bayrak, A. G., Regazzoni, F., Novo, D., et al. (2014) · IEEE Transactions on Computers · doi:10.1109/tc.2013.219 · Cited by 40 · see citing works
CacheQuote: Efficiently Recovering Long-term Secrets of SGX EPID via Cache Attacks
Dall, F., Micheli, G. D., Eisenbarth, T., et al. (2018) · Adelaide Research & Scholarship (AR&S) (University of Adelaide) · doi:10.13154/tches.v2018.i2.171-191 · Cited by 39 · see citing works
Self-citationA common-multiplicand method to the montgomery algorithm for speeding up exponentiation
Ha, J., & Moon, S. (1998) · Information Processing Letters · doi:10.1016/s0020-0190(98)00031-3 · Cited by 38 · see citing works
Computer Security – ESORICS 2017
Rullo, A., Serra, E., Bertino, E., & Lobo, J. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66399-9 · Cited by 36 · see citing works
Verifying Constant-Time Implementations by Abstract Interpretation
Blazy, S., Pichardie, D., & Trieu, A. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66402-6_16 · Cited by 30 · see citing works
CacheZoom: How SGX Amplifies The Power of Cache AttacksPreprint
Moghimi, A., Irazoqui, G., & Eisenbarth, T. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.06986 · Cited by 25 · see citing works
Self-citationDATA - Differential Address Trace Analysis: Finding Address-based Side-Channels in Binaries
Weiser, S., Zankl, A., Spreitzer, R., et al. (2018) · Publikationsdatenbank der Fraunhofer-Gesellschaft (Fraunhofer-Gesellschaft) · Cited by 24 · see citing works
(2004) · Lecture notes in computer science · doi:10.1007/b98935 · Cited by 23 · see citing works
A compiler and verifier for page access oblivious computation
Sinha, R., Rajamani, S. K., & Seshia, S. A. (2017) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3106237.3106248 · Cited by 21 · see citing works
Quantifying the information leak in cache attacks via symbolic execution
Chattopadhyay, S., Beck, M., Rezine, A., et al. (2017) · ACM/IEEE International Conference on Formal Methods and Models for System Design (MEMOCODE) · doi:10.1145/3127041.3127044 · Cited by 20 · see citing works
SM2 cryptographic algorithm based on discrete logarithm problem and prospect
Bai, L., Zhang, Y., & Yang, G. (2012) · International Conference on Consumer Electronics, Communications and Networks (CECNet) · doi:10.1109/cecnet.2012.6201878 · Cited by 14 · see citing works
Automated Detection of Instruction Cache Leaks in Modular Exponentiation Software
Zankl, A., Heyszl, J., & Sigl, G. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-54669-8_14 · Cited by 13 · see citing works
Did we learn from LLC Side Channel Attacks? A Cache Leakage Detection Tool for Crypto LibrariesPreprint
Irazoqui, G., Cong, K., Guo, X., et al. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1709.01552 · Cited by 12 · see citing works
Foundations of Software Science and Computational Structures
Egger, J., Møgelberg, R. E. I. 0.-0.-0.-4., & Simpson, A. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-12032-9 · Cited by 11 · see citing works
Smart Card Research and Advanced Applications
Grosso, V., & Pöppelmann, T. (2022) · Lecture notes in computer science · doi:10.1007/978-3-030-97348-3 · Cited by 9 · see citing works
Øzone: Efficient execution with zero timing leakage for modern microarchitectures
Aweke, Z. B., & Austin, T. M. (2018) · Design, Automation, and Test in Europe · doi:10.23919/date.2018.8342179 · Cited by 4 · see citing works
Flagged first, then by citations
Research works printed but not linked: 12
- [7][7] ARM. [n. d.]. Cortex-M3 Technical Reference Manual . Chapter 18.4. Accessed: 2018-02-27. -
- [18][18] Samira Briongos, Gorka Irazoqui, Pedro Malagón, and Thomas Eisenbarth. 2018. CacheShield: Detecting Cache Attacks Through Self-Observation. In Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy (CODASPY '18) . ACM, New York, NY, USA, 224-235. -
- [17][17] Ernie Brickell, Gary Graunke, and Jean-Pierre Seifert. 2006. Mitigating cache/timing based side-channels in AES and RSA software implementations. In RSA Conference 2006 session DEV-203 . RSA. -
- [26][26] Craig Disselkoen, David Kohlbrenner, Leo Porter, and Dean Tullsen. 2017. Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX. In 26th USENIX Security Symposium (USENIX Security 17) . USENIX Association, Vancouver, BC, 51-67. -
- [30][30] Dmitry Evtyushkin, Dmitry Ponomarev, and Nael Abu-Ghazaleh. 2016. Jump over ASLR: Attacking Branch Predictors to Bypass ASLR. In The 49th Annual IEEE/ACM International Symposium on Microarchitecture (MICRO-49) . IEEE Press, Piscataway, NJ, USA, Article 40, 13 pages. -
- [47][47] Mehmet Kayaalp, Khaled N. Khasawneh, Hodjat Asghari Esfeden, Jesse Elwell, Nael Abu-Ghazaleh, Dmitry Ponomarev, and Aamer Jaleel. 2017. RIC: Relaxed Inclusion Caches for Mitigating LLC Side-Channel Attacks. In Proceedings of the 54th Annual Design Automation Conference 2017 (DAC '17) . ACM, New York, NY, USA, Article 7, 6 pages. -
- [53][53] Chris Lattner and Vikram Adve. 2004. LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation. In Proceedings of the International Symposium on Code Generation and Optimization: Feedback-directed and Runtime Optimization (CGO '04) . IEEE Computer Society, Washington, DC, USA, 75-. -
- [58][58] Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, Vijay Janapa Reddi, and Kim Hazelwood. 2005. Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation. In Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI '05) . ACM, New York, NY, USA, 190-200. -
- [57][57] Fangfei Liu, Yuval Yarom, Qian Ge, Gernot Heiser, and Ruby B. Lee. 2015. LastLevel Cache Side-Channel Attacks Are Practical. In Proceedings of the 2015 IEEE Symposium on Security and Privacy (SP '15) . IEEE Computer Society, Washington, DC, USA, 605-622. -
- [70][70] Ashay Rane, Calvin Lin, and Mohit Tiwari. 2015. Raccoon: Closing Digital SideChannels through Obfuscated Execution. In 24th USENIX Security Symposium (USENIX Security 15) . USENIX Association, Washington, D.C., 431-446. -
- [76][76] Emil Stefanov, Marten van Dijk, Elaine Shi, Christopher Fletcher, Ling Ren, Xiangyao Yu, and Srinivas Devadas. 2013. Path ORAM: An Extremely Simple Oblivious RAM Protocol. In Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (CCS '13) . ACM, New York, NY, USA, 299-310. -
- [81][81] Yuan Xiao, Mengyuan Li, Sanchuan Chen, and Yinqian Zhang. 2017. STACCO: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS '17) . ACM, New York, NY, USA, 859-874. -
Cited by
Sorted by citations
Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd
Vanhoef, M., & Ronen, E. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00031 · Cited by 179 · see citing works
- Authors
- Wichelmann, J., Moghimi, A., Eisenbarth, T., & Sunar, B.
- Affiliations
- University of Lübeck (DE)
- Worcester Polytechnic Institute (US)
- Venue
- Proceedings of the 34th Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2018-12-03
- Pages
- 161-173
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2885297972
- Cited by
- 74
- References
- 91
- Citations by year
- 2026: 7 · 2025: 8 · 2024: 7 · 2023: 11 · 2022: 11 · 2021: 9 · 2020: 11 · 2019: 10
- FWCI
- 3.05
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- microarchitectural side channels, side-channel attacks, dynamic binary instrumentation, mutual information analysis, cryptographic libraries
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
