Attack of the Knights: A Non Uniform Cache Side-Channel Attack

TL;DR

This paper presents a novel distance-based cache side-channel attack on multicore CPUs exploiting LLC bank timing differences to extract AES keys with high accuracy and low error rate.

Contribution

It introduces a new side-channel attack leveraging LLC bank timing differences and demonstrates effective key extraction techniques on Intel Knights Landing CPUs.

Findings

Achieved a bandwidth of 205 kbps for the covert channel.

Successfully extracted 4 bytes of AES key with 100% accuracy.

Demonstrated the attack's effectiveness with only 4000 encryption rounds.

Abstract

For a distributed last-level cache (LLC) in a large multicore chip, the access time to one LLC bank can significantly differ from that to another due to the difference in physical distance. In this paper, we successfully demonstrated a new distance-based side-channel attack by timing the AES decryption operation and extracting part of an AES secret key on an Intel Knights Landing CPU. We introduce several techniques to overcome the challenges of the attack, including the use of multiple attack threads to ensure LLC hits, to detect vulnerable memory locations, and to obtain fine-grained timing of the victim operations. While operating as a covert channel, this attack can reach a bandwidth of 205 kbps with an error rate of only 0.02%. We also observed that the side-channel attack can extract 4 bytes of an AES key with 100% accuracy with only 4000 trial rounds of encryption