This is really impressive work. After skimming through the detailed paper it looks as if they are not picking up sound emitted from the CPU itself, but from the switching power supply circuit.
The frequency variation is caused by load differences. So they are in fact doing an indirect power analysis. A switching power supply will always change frequency as a reaction to variations in supply current, this is inherent to its design. I also believe that it will be very difficult to "muffle" all the inductors and capacitors as they are subjected to very high pulse loads. Magnetics will always find a way to emit sound...
It's interesting to note that the biggest difference seems to be between register and memory instructions. This seems reasonable as memory instruction may, in the worst case, require powering the external bus, which is very power hungry. This will only get worse in future CPUs, as more and more clock gating is introduced.
So, I guess some countermeasures could be:
- If the CPU supports SMT or HT, load the other cores with a thread accessing random memory positions.
- Optimize the RSA code so that it's memory access and runtime pattern does not depend on the key or clean text.
- Try to localize the RSA code as much as possible to reduce memory accesses. If memory access is required, do it all at once, for example by swapping entire cache pages.
Comments
This is really impressive work. After skimming through the detailed paper it looks as if they are not picking up sound emitted from the CPU itself, but from the switching power supply circuit.
The frequency variation is caused by load differences. So they are in fact doing an indirect power analysis. A switching power supply will always change frequency as a reaction to variations in supply current, this is inherent to its design. I also believe that it will be very difficult to "muffle" all the inductors and capacitors as they are subjected to very high pulse loads. Magnetics will always find a way to emit sound...
It's interesting to note that the biggest difference seems to be between register and memory instructions. This seems reasonable as memory instruction may, in the worst case, require powering the external bus, which is very power hungry. This will only get worse in future CPUs, as more and more clock gating is introduced.
So, I guess some countermeasures could be:
- If the CPU supports SMT or HT, load the other cores with a thread accessing random memory positions.
- Optimize the RSA code so that it's memory access and runtime pattern does not depend on the key or clean text.
- Try to localize the RSA code as much as possible to reduce memory accesses. If memory access is required, do it all at once, for example by swapping entire cache pages.
Some of these are highly CPU dependent.