Software mitigations to hedge AES against cache-based software side channel vulnerabilities.

TLDR

Hardware side‑channel vulnerabilities have long been studied in embedded silicon security, and recent work has focused on cache‑based software side channels affecting AES and RSA on PC platforms. This study investigates efficient mitigations to protect AES software from cache‑based side‑channel attacks by presenting and evaluating several hardening strategies. The authors present multiple mitigation techniques, analyze their theoretical protection, benchmark their performance against OpenSSL AES, and test them under existing side‑channel attacks. The mitigations incur performance losses ranging from 1.35× to 2.85× versus OpenSSL (and 2.66× to 5.83× versus the best assembler) depending on the desired protection level.

Abstract

Hardware side channel vulnerabilities have been studied for many years in embedded silicon-security arena including SmartCards, SetTop-boxes, etc. However, because various recent security activities have goals of improving the software isolation properties of PC platforms, software side channels have become a subject of interest. Recent publications discussed cache-based software side channel vulnerabilities of AES and RSA. Thus, following the classical approach — a new side channel vulnerability opens a new mitigation research path — this paper starts to investigate efficient mitigations to protect AES-software against side channel vulnerabilities. First, we will present several mitigation strategies to harden existing AES software against cache-based software side channel attacks and analyze their theoretical protection. Then, we will present a performance and security evaluation of our mitigation strategies. For ease of evaluation we measured the performance of our code against the performance of the openSSL AES implementation. In addition, we also analyzed our code under various existing attacks. Depending on the level of the required side channel protection, the measured performance loss of our mitigations strategies versus openSSL (respectively best assembler) varies between factors of 1.35 (2.66) and 2.85 (5.83).