SQUIP or Why We Need to Study Processors Like Nature
summary
Introduces SQUIP as a scheduler-queue contention side channel that forces pipeline stalls by flooding scheduler queues with dependent multiplies and slow operations (square roots) and times RDP RU / timestamp differences. Demonstrates concrete limits (Zen2 ~16 μops, Zen3 ~22–23 μops), achieves a covert channel at 2.7 MBit/s cross-process and 0.89 MBit/s across VMs (including SEV), and extracts a full RSA key in 1 hour from square-and-multiply traces on AMD and shows the method also applies to Apple M1.
AI-written summary · about
chapters (14)
- 0:00SQUIP introduction
- 0:43Side channels persist
- 3:13Modeling processor security
- 4:59Processors like nature
- 7:03SQUIP side channel
- 10:52SQUIP exploits scheduler queues
- 15:17Pipeline and scheduler mechanics
- 21:21Visualizing SQUIP timing
- 24:13Covert channel with SQUIP
- 26:48SQUIP in cross-process/VM
- 27:31Extracting RSA keys
- 28:58Mitigating SQUIP
- 31:29Modeling vs real-world
- 32:54Conclusion
related talks
17mSecuring High-performance RISC V-Processors from Time Speculation
43mRISC-V CPU Project in Western Digital
12mHardware Verification of Timing Side Channel Freedom in the Spectre Era
46mRIDLed with CPU bugs
46mRethinking Architectures and Abstraction for a World Where Security Improvements Matter More than Performance Gains
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
36mCollide+Power: The Evolution of Software-based Power Side-Channels Attacks
01h 16mA New Golden Age for Computer Architecture