Investigation of side-channel security vulnerabilities in computer systems

My BSc Eng thesis at DTU Compute, the Department of Applied Mathematics and Computer Science, supervised by Associate Professor Matthias Bo Stuart. A joint two-person project built around one simple question with uncomfortable answers: can the tiny timing difference between a cache hit and a cache miss reveal what another process on the same machine is doing, without ever breaking a single line of cryptography?

To answer it, I implemented and evaluated three real cache side-channel attacks on a live Intel Haswell machine, a Core i5-4210M running Linux, measuring the leak at the resolution of individual CPU cycles: Flush+Reload, Prime+Probe, and a Flush+Reload attack against OpenSSL.

Flush+Reload reached above 95% accuracy from only five measurement rounds per decision, thanks to a clean timing gap between L2 cache hits and post-flush DRAM misses. Prime+Probe reached above 90% with no shared memory at all, using only cache-set contention, but on a far narrower margin: its useful threshold window was just a few cycles wide, so it needed four times as many samples and careful per-platform tuning. Against OpenSSL, the attack detected SHA256 activity inside a shared library and could tell MD5, SHA1, SHA256, and SHA512 usage apart.

The point I care about most: these are not software bugs in the victim program. The leak is a property of normal, correct hardware behaviour, and how reliable it is depends on microarchitectural details like the prefetcher and the cache replacement policy. Strong cryptography is not enough when the hardware quietly narrates what it is doing.