I'm trying to understand Section 3: L1 Cache Missing in the paper Cache Missing for Fun and Profit. I'm stuck on trying to figure out how the covert channel is being constructed.
Specifically, I don't understand the following construction (the especially confusing parts are highlighted):
A covert channel can therefore be constructed as follows: The Trojan process allocates an array of 2048 bytes, and for each 32-bit word it wishes to transmit, it accesses byte 64i of the array iff bit i of the word is set. The Spy process allocates an array of 8192 bytes, and repeatedly measures the amount of time needed to read bytes 64i, 64i + 2048, 64i + 4096, and 64i + 6144 for each 0 ≤ i < 32. Each memory access performed by the Trojan will evict a cache line owned by the Spy, resulting in lines being reloaded from the L2 cache, which adds an additional latency of approximately 30 cycles if the memory accesses are dependent.
I don't understand why the byte 64i needs to be accessed, or what the relevance of bit i being set is in this context. And I don't understand why the Spy process would have the pattern of reading bytes 64i, 64i + 2048, 64i + 4096, and 64i + 6144.
EDIT (to incorporate D.W.'s suggestion): I get the general gist of how a covert channel is created, but not exactly. There are two processes that agree to send and receive messages from each other. They agree upon some set in a cache which they would use to contend for data. The first process then floods the cache set with its data, and so does the second process. But the second process tries to measure the time it takes for it to access the resource (the set in the cache that is being contended for). If the access is fast, then it reads that as a certain bit, and if its slow, as the opposite bit.
