Communication Dans Un Congrès Année : 2025

Evict+Spec+Time on RISC-V: Gem5-Based Implementation and Microarchitectural Analysis

Résumé

Microarchitectural side-channel attacks are a growing concern and have been widely studied on x86 and ARM architectures, but RISC-V's susceptibility to similar attacks remains understudied. We present the first implementation and evaluation of the Evict+Spec+Time attack on RISC-V, previously demonstrated only on x86 [2]. This advanced variant of Evict+Time integrates three critical phases: eviction, speculation, and timing. First, the attack forcibly evicts target cache lines using RISC-V's cbo.flush instruction via the Zicbom extension [6]. Next, it exploits out-of-order execution to manipulate microarchitectural resources such as the reorder buffer, limiting the processor's ability to mask cache-miss latency. Finally, it infers secret-dependent memory access patterns through precise timing measurements. We validate RISC-V's vulnerability by recovering secret keys from AES T-table implementations. Using the gem5 simulator [4], we provide the first detailed analysis of microarchitectural behavior during the attack, including cache contention, pipeline stalls, and latency variations. These insights establish foundational guidance for developing RISC-V-specific countermeasures against such attacks.

Fichier principal
Vignette du fichier
DSD_MATTERV (1).pdf (1.28 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-05176064 , version 1 (22-07-2025)

Identifiants

  • HAL Id : hal-05176064 , version 1

Citer

Mahreen Khan, Maria Mushtaq, Renaud Pacalet, Ludovic Apvrille. Evict+Spec+Time on RISC-V: Gem5-Based Implementation and Microarchitectural Analysis. 28th Euromicro Conference Series on Digital System Design (DSD), Sep 2025, Salerne, Italy. ⟨hal-05176064⟩
3011 Consultations
200 Téléchargements

Partager

  • More