CacheBleed: a timing attack on OpenSSL constant-time RSA

• DOI: 10.1007/s13389-017-0152-y
• Publication Date: 2017-02-11T19:22:35Z
• Authors: Yuval Yarom; Daniel Genkin; Nadia Heninger
• Keywords: 0202 electrical engineering, electronic engineering, information engineering; 02 engineering and technology

The scatter-gather technique is a commonly implemented approach to prevent cache-based timing attacks. In this paper we show that scatter-gather is not constant time. We implement a cache timing attack against the scatter-gather implementation used in the modular exponentiation routine in OpenSSL version 1.0.2f. Our attack exploits cache-bank conflicts on the Sandy Bridge microarchitecture. We have tested the attack on an Intel Xeon E5-2430 processor. For 4096-bit RSA our attack can fully recover the private key after observing 16,000 decryptions.