Branch Prediction Attacks

So far we have looked at timing channels that arise due to cache memories in the system. Cache memories leak information about the memory accesses made by a cipher. In this chapter, we look at information leakage due to branch instructions. If a cipher implementation uses a conditional branch that depends on the secret key, then information about the key can leak through the processor’s branch predictor. A misprediction causes the execution to take considerably more time compared with predictions that are correct. This variation in execution time is exploited by attackers to determine bits of the secret key. Several-timing attacks based on branch prediction have been proposed. Unlike cache attacks, which are mostly effective on block ciphers, branch prediction attacks are applicable only on public key ciphers such as the Rivest, Shamir, and Adleman (RSA) algorithm. This chapter begins with a review of the RSA implementation before discussing various branch prediction attacks.