1
$\begingroup$

I'm trying to understand Section 3: L1 Cache Missing in the paper Cache Missing for Fun and Profit. I'm stuck on trying to figure out how the covert channel is being constructed.

Specifically, I don't understand the following construction (the especially confusing parts are highlighted):

A covert channel can therefore be constructed as follows: The Trojan process allocates an array of 2048 bytes, and for each 32-bit word it wishes to transmit, it accesses byte 64i of the array iff bit i of the word is set. The Spy process allocates an array of 8192 bytes, and repeatedly measures the amount of time needed to read bytes 64i, 64i + 2048, 64i + 4096, and 64i + 6144 for each 0 ≤ i < 32. Each memory access performed by the Trojan will evict a cache line owned by the Spy, resulting in lines being reloaded from the L2 cache, which adds an additional latency of approximately 30 cycles if the memory accesses are dependent.

I don't understand why the byte 64i needs to be accessed, or what the relevance of bit i being set is in this context. And I don't understand why the Spy process would have the pattern of reading bytes 64i, 64i + 2048, 64i + 4096, and 64i + 6144.

EDIT (to incorporate D.W.'s suggestion): I get the general gist of how a covert channel is created, but not exactly. There are two processes that agree to send and receive messages from each other. They agree upon some set in a cache which they would use to contend for data. The first process then floods the cache set with its data, and so does the second process. But the second process tries to measure the time it takes for it to access the resource (the set in the cache that is being contended for). If the access is fast, then it reads that as a certain bit, and if its slow, as the opposite bit.

Improve this question
$\endgroup$
3
  • $\begingroup$ The idea is to transmit a 32 bit word from trojan to spy without sending the data, by causing a timing effect that is measurable depending on whether bit i of the word is set or not. $\endgroup$ – gnasher729 Sep 13 '19 at 6:41
  • $\begingroup$ Before you ask why they couldn't have done something different, first understand why this particular thing does work. Then, once you've achieved that, you can consider alternate solutions. When you ask "why the byte 64i needs to be accessed", I suggest pondering how you would construct a covert channel without accessing byte 64i, and then write down how your covert channel would work. $\endgroup$ – D.W.♦ Sep 13 '19 at 18:30
  • $\begingroup$ @D.W. Added an edit describing what I understand, which isn't much at all $\endgroup$ – picotard Sep 15 '19 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.