On the Incomparability of Cache Algorithms in Terms of Timing Leakage

TL;DR

This paper introduces a new framework for comparing cache algorithms based on their timing leakage, revealing that no algorithm universally dominates another in security and that their leak-competitiveness follows specific mathematical patterns.

Contribution

It proposes the concept of leak competitiveness for cache security analysis and proves fundamental properties about the relationships between cache algorithms in terms of timing leaks.

Findings

Leak competitiveness is symmetric among cache algorithms.

No cache algorithm dominates another in timing leakage.

Leak-competitiveness is either asymptotically linear or constant for caches with finite control.

Abstract

Modern computer architectures rely on caches to reduce the latency gap between the CPU and main memory. While indispensable for performance, caches pose a serious threat to security because they leak information about memory access patterns of programs via execution time. In this paper, we present a novel approach for reasoning about the security of cache algorithms with respect to timing leaks. The basis of our approach is the notion of leak competitiveness, which compares the leakage of two cache algorithms on every possible program. Based on this notion, we prove the following two results: First, we show that leak competitiveness is symmetric in the cache algorithms. This implies that no cache algorithm dominates another in terms of leakage via a program's total execution time. This is in contrast to performance, where it is known that such dominance relationships exist. Second, when restricted to caches with finite control, the leak-competitiveness relationship between two cache algorithms is either asymptotically linear or constant. No other shapes are possible.