Cache Attacks on Intel SGX

TLDR

Intel SGX was designed to protect applications against root‑level attacks. The study presents an access‑driven cache‑timing attack on AES running inside an Intel SGX enclave. The attack, executed with root privileges on the same host, uses Neve and Seifert’s elimination method together with Intel PMC‑based cache probing to recover the AES key. We demonstrate that SGX enclaves are vulnerable to cache‑timing attacks, extracting an AES key in under ten seconds and showing that SGX cannot withstand its intended attacker model, thereby expanding the side‑channel attack surface.

Abstract

For the first time, we practically demonstrate that Intel SGX enclaves are vulnerable against cache-timing attacks. As a case study, we present an access-driven cache-timing attack on AES when running inside an Intel SGX enclave. Using Neve and Seifert's elimination method, as well as a cache probing mechanism relying on Intel PMC, we are able to extract the AES secret key in less than 10 seconds by investigating 480 encrypted blocks on average. The AES implementation we attack is based on a Gladman AES implementation taken from an older version of OpenSSL, which is known to be vulnerable to cache-timing attacks. In contrast to previous works on cache-timing attacks, our attack is executed with root privileges running on the same host as the vulnerable enclave. Intel SGX, however, was designed to precisely protect applications against such root-level attacks. As a consequence, we show that SGX cannot withstand its designated attacker model when it comes to side-channel vulnerabilities. To the contrary, the attack surface for side-channels increases dramatically in the scenario of SGX due to the power of root-level attackers, for example, by exploiting the accuracy of PMC, which is restricted to kernel code.