CryptoDB
Paper: The Silent Zero Store Side Channel and Its Implications for Crypto Implementations
| Authors: |
|
|---|---|
| Download: | |
| Abstract: | Cryptographic software aiming to be constant-time must avoid overwriting a memory location with a value that, depending on a secret, is either all-zero or not all-zero. The reason is silent zero store suppression, a microarchitectural optimization that allows evicted all-zero cachelines that are dirty but unchanged to be dropped instead of written back. As discovered by Travis Downs, recent Intel processors implement silent zero store suppression for some evictions from the L2 cache. We describe an adaptive chosen-ciphertext attack strategy against SIKE (a popular post-quantum key-encapsulation primitive) in which a correct key-bit guess triggers thousands of suppressed silent zero stores. We show that our attack strategy renders both the Cloudflare CIRCL implementation of SIKE (written in Go) and the Microsoft PQCrypto-SIKE implementation (written in C) vulnerable to a remote timing attack when running on an Intel Ice Lake CPU, despite having been written to be side-channel resistant. Our attack recovers the complete 378-bit SIKE-751 secret key from a CIRCL server in 39 hours and from a PQCrypto-SIKE server in 72 hours. |
BibTeX
@article{tches-2022-31620,
title={The Silent Zero Store Side Channel and Its Implications for Crypto Implementations},
journal={IACR Transactions on Cryptographic Hardware and Embedded Systems},
publisher={RUB},
author={Yingchen Wang and Hovav Shacham},
year=2022
}