2nd/10_Wiki/Topics/Domain_Programming/Backend/Side-channel Attack.md

id, title, category, status, canonical_id, aliases, duplicate_of, source_trust_level, confidence_score, verification_status, tags, raw_sources, last_reinforced, github_commit, tech_stack

id	title	category	status	canonical_id	aliases	duplicate_of	source_trust_level	confidence_score	verification_status	tags	raw_sources	last_reinforced	github_commit	tech_stack
wiki-2026-0508-side-channel-attack	Side-channel Attack	10_Wiki/Topics	verified	self	Side-channel Timing Attack Cache Attack	none	A	0.95	applied	security cryptography hardware attack		2026-05-10	pending	language framework c/python openssl/numpy

Side-channel Attack

매 한 줄

"매 알고리즘 의 정상 output 이 아닌 부수 누출 (시간, 전력, 캐시, EM 방사) 로 secret 추출". 매 1996 Kocher 의 timing attack on RSA 가 시초. 매 2018 Spectre/Meltdown 으로 mass awareness. 매 2026 LLM weight extraction, GPU side-channel 까지 확장.

매 핵심

매 카테고리

• Timing: 시간 차이 → key 추출 (RSA, AES, PIN compare).
• Power analysis (SPA/DPA): 전력 trace → key bits.
• EM: 전자기 방사 → 동일 정보.
• Cache (Flush+Reload, Prime+Probe): shared L3 cache.
• Speculative (Spectre, Meltdown): speculative exec leak via cache.
• Microarchitectural (LVI, Foreshadow, Zenbleed): CPU bug exploit.
• Acoustic / Optical: 매 keyboard sound, monitor flicker.
• Software: padding oracle, error message disclosure.

매 ML / AI 신종

• Membership inference: 매 model 출력 으로 training data 멤버 여부 추론.
• Model extraction: 매 query → weight stealing.
• Prompt injection side-channel: token timing.

매 응용 (defensive)

1. Constant-time crypto code.
2. Cache partitioning.
3. KASLR + KPTI (Meltdown 대응).
4. Differential privacy (ML).

💻 패턴

Timing-vulnerable string compare

// VULNERABLE
int compare_password(const char* a, const char* b, size_t n) {
    for (size_t i = 0; i < n; i++) {
        if (a[i] != b[i]) return 0;  // early exit → timing leak
    }
    return 1;
}

// SAFE — constant time
int safe_compare(const uint8_t* a, const uint8_t* b, size_t n) {
    uint8_t diff = 0;
    for (size_t i = 0; i < n; i++) diff |= a[i] ^ b[i];
    return diff == 0;
}

Timing attack demo

import time, statistics

def measure(guess, target):
    samples = []
    for _ in range(1000):
        t0 = time.perf_counter_ns()
        compare_password(guess, target)
        samples.append(time.perf_counter_ns() - t0)
    return statistics.median(samples)

# Brute force first byte: char with longest median = correct
for c in range(256):
    guess = bytes([c]) + b'\x00'*15
    print(c, measure(guess, target_secret))

Constant-time AES (lookup-free)

// Bitsliced implementation — no data-dependent table lookup → no cache leak
// Reference: bsaes (BearSSL)
void aes_bitsliced_encrypt(uint64_t state[8], uint64_t rk[88]);

Spectre v1 (bounds-check bypass)

// VULNERABLE
if (idx < array_size) {
    y = array2[array1[idx] * 256];  // speculatively executed even if idx large
}
// → array1 OOB read → array2 cache state encodes secret

Spectre mitigation (LFENCE)

if (idx < array_size) {
    __asm__ volatile("lfence" ::: "memory");  // serialize speculation
    y = array2[array1[idx] * 256];
}

Padding oracle (CBC mode)

# VULNERABLE: distinguishable error messages
def decrypt(ciphertext):
    plaintext = aes_cbc_decrypt(ciphertext, key)
    try:
        unpad(plaintext)
    except PaddingError:
        return "Invalid padding"  # ← oracle leak
    return "Invalid MAC"

# SAFE: encrypt-then-MAC (always check MAC first, constant-time)

Differential privacy ML defense

import opacus
from torch.utils.data import DataLoader

privacy_engine = opacus.PrivacyEngine()
model, optimizer, dl = privacy_engine.make_private(
    module=model, optimizer=optimizer, data_loader=dl,
    noise_multiplier=1.1, max_grad_norm=1.0,
)

Cache flush+reload

// Probe shared library page
clflush(&victim_addr);
victim_function();  // runs in target process
uint64_t t0 = rdtsc(); volatile char x = *victim_addr; uint64_t t1 = rdtsc();
if (t1 - t0 < THRESHOLD) printf("hit — accessed by victim\n");

매 결정 기준

상황	Approach
Crypto code (key compare, AES)	Constant-time + bitsliced
Web auth	hmac.compare_digest / crypto.timingSafeEqual
Cloud multi-tenant	Cache partitioning + Spectre patches
ML model serving	Output rate-limit + DP training
Embedded HW	Power analysis countermeasures (masking, hiding)

기본값: constant-time primitives + libsodium / BoringSSL 의 사용.

🔗 Graph

• 변형: Spectre · Rowhammer · Timing Attack
• 응용: Differential Privacy

🤖 LLM 활용

언제: constant-time review, vulnerable code 의 패턴 인식, mitigation suggestions. 언제 X: actual exploit development (legal/ethical line).

❌ 안티패턴

• Naive memcmp for secrets: timing leak.
• Data-dependent branch in crypto: cache + branch predictor leak.
• "Roll your own crypto": 매 side-channel free 의 어려움.
• Verbose error messages: padding oracle 류.

🧪 검증 / 중복

• Verified (Kocher 1996, Spectre paper 2018, Intel/AMD advisories).
• 신뢰도 A.

🕓 Changelog

날짜	변경
2026-05-08	Phase 1
2026-05-10	Manual cleanup — full side-channel coverage