Side-Channel Attack

Exploit the measurable latency difference between cache hits and misses to infer secret-dependent memory access patterns. Prime+Probe and Flush+Reload are dominant techniques where an attacker manipulates shared cache lines and observes the victim enclave's access timing. By monitoring which cache sets are evicted, an attacker can reconstruct cryptographic keys or extract private data processed within the enclave.

Monitor the dynamic power consumption of the processor during enclave computation. Simple Power Analysis (SPA) directly interprets power traces to identify executed instructions, while Differential Power Analysis (DPA) uses statistical correlation between power traces and hypothetical intermediate values to extract secrets. Even hardware-isolated enclaves leak data-dependent power signatures through the shared power delivery network.

Capture electromagnetic radiation emitted by the processor during enclave execution using near-field probes. CEMD (Correlation Electromagnetic Analysis) correlates emanations with processed data to reveal cryptographic keys. Unlike power analysis, EM attacks can be localized to specific chip regions, isolating the enclave's core from other system noise and achieving higher signal-to-noise ratios for key extraction.

Exploit the speculative execution engine's branch predictor state, which is shared between the enclave and untrusted code. BranchScope and Spectre-class attacks manipulate branch history tables to observe which conditional paths the enclave takes. This reveals secret-dependent control flow, allowing attackers to infer sensitive data values processed within the protected environment.

Leverage the host operating system's control over enclave page tables to observe page-level access patterns. By inducing page faults and monitoring which memory pages the enclave accesses, an attacker reconstructs the sequence of code and data accesses. This vector is particularly dangerous because it requires no physical access and can be mounted entirely from software by a malicious OS.

Exploit transient execution windows in deeply pipelined processors to leak in-flight data from internal buffers. MDS attacks like ZombieLoad and RIDL target fill-buffer logic and load ports shared across security domains. These attacks bypass enclave isolation by extracting data that is momentarily visible in microarchitectural structures during speculative or out-of-order execution.

Exploit variations in the execution time of cryptographic operations to infer secret-dependent computations. By precisely measuring how long an enclave takes to process different inputs, an attacker controlling the host OS can deduce private keys or plaintext data.

• Cache-timing: Exploits differences in memory access latency between cache hits and misses.
• Branch prediction: Observes timing variations caused by conditional branches dependent on secret data.
• Constant-time programming: A critical defense where all code paths execute in identical cycles regardless of input values.

Monitor a processor's instantaneous power consumption during cryptographic computation to extract secrets. These attacks rely on the physical principle that switching transistors consume different amounts of power depending on the data being processed.

• Simple Power Analysis (SPA): Directly interprets power traces to identify individual instructions.
• Differential Power Analysis (DPA): Uses statistical methods to correlate power fluctuations with secret key bits across many operations.
• Mitigation: Balanced logic gates and on-die voltage regulators reduce signal-to-noise ratio.

Capture the electromagnetic radiation emitted by a processor during computation to reconstruct sensitive information. Every current flow generates a magnetic field, and these emanations can be picked up by antennae even at a distance.

• Van Eck phreaking: Classic technique reconstructing screen content from EM emissions.
• Near-field probes: Positioned close to the chip package for high-resolution signal capture.
• TEMPEST shielding: Military-grade countermeasure involving Faraday cages and dampened enclosures to block emanations.

Exploit shared processor resources—caches, TLBs, branch predictors—to leak information across security boundaries. These are particularly dangerous in multi-tenant cloud environments where an attacker co-locates with a victim enclave.

• Spectre/Meltdown: Foundational transient execution attacks that read privileged memory.
• Cache side-channels: Prime+Probe, Flush+Reload, and Evict+Time techniques on shared LLC.
• Defense: Cache partitioning (CAT), core isolation, and speculative execution barriers.

A class of attacks specific to enclave systems where the untrusted host OS manipulates page tables to observe an enclave's memory access patterns at page-level granularity. The OS triggers page faults and records which pages the enclave touches, revealing its control flow and data dependencies.

• Page-fault pattern analysis: Reconstructs algorithms from the sequence of accessed pages.
• Deterministic replay: The OS can repeatedly execute the enclave with controlled inputs to refine observations.
• Oblivious RAM (ORAM): A defense that randomizes access patterns to hide true memory access sequences.

Convert mechanical or acoustic emissions from computing hardware into information leakage vectors. The physical operation of components—capacitor whine, fan speed changes, or even chassis vibrations—can be correlated with internal data states.

• Coil whine analysis: Decodes RSA keys from the audible noise of voltage regulator circuits.
• Thermal imaging: Observes heat dissipation patterns on a chip to infer computational hotspots.
• Mitigation: Acoustic dampening, sealed chassis, and hardware random noise generators.