Security - Side-Channel Attack

A Side-Channel Attack is a security exploit that doesn't look for a "bug" in your code or a "crack" in your encryption. Instead, it gathers information from the physical implementation of the computer system itself.

Think of it this way:

• A traditional attack tries to guess the password or find a hole in the software "front door."
• A side-channel attack doesn't care about the door; it puts a stethoscope to the wall to listen to the tumblers of the lock moving, or measures how much heat the safe is giving off to guess what's inside.

The Famous Analogy: The Mechanical Safe

Imagine a high-security safe with a dial lock.

• Traditional Attack: You try every possible combination (Brute force) or look for a flaw in the safe's blueprints.
• Side-Channel Attack: You don't know the combination, but you notice that when the dial hits a correct number, it makes a slightly louder "click" (Audio Side-Channel) or the dial becomes slightly harder to turn (Resistance Side-Channel). By observing these "leaks," you solve the code.

Common Types of Digital Side-Channels

In computing, CPUs and hardware "leak" information in several ways:

A. Timing Attacks

The attacker measures exactly how long a computer takes to perform a task.

• Example: An app checks a password character by character. It stops as soon as it finds a wrong letter.
  • "a..." takes 1ms.
  • "p..." takes 2ms.
• The attacker now knows the first letter is "p" because the computer worked slightly longer on it.

B. Cache Attacks

CPUs have a "Cache" (ultra-fast internal memory). If two processes share the same physical core, they share the same Cache.

• Attacker Strategy: I (the attacker) fill the CPU cache with my own junk data. I wait for you to run your secret encryption. Then, I check which parts of my junk data were "kicked out" of the cache to make room for your data.
• By seeing where you put your data in the cache, I can mathematically reconstruct your secret keys.

C. Power Analysis

Different CPU operations use different amounts of electricity. By measuring the tiny fluctuations in power usage of a phone or laptop, attackers can figure out if the CPU is doing a "0" or a "1" in a cryptographic calculation.

D. Electromagnetic (EM) Attacks

CPUs emit radio frequency signals while they work. Researchers have successfully stolen encryption keys from laptops in the next room just by "listening" to the electromagnetic waves using an antenna.

The Modern Nightmare: Speculative Execution

This is the category that gave us Spectre and Meltdown.

To go faster, modern CPUs "guess" which direction a piece of code will go before it actually finishes. This is called Speculative Execution.

1. The CPU "guesses" and executes a secret command.
2. It realizes it guessed wrong and "undoes" the work.
3. The Catch: Even though it "undid" the work, the data it touched remains in the CPU Cache.
4. An attacker can then use a Cache Side-Channel to see what that "undone" secret data was.

Summary

• Normal Security: Protects what the computer is saying.
• Side-Channel Security: Protects how the computer "breathes" and "vibrates" while it's talking.