A Theoretical Framework For Modeling Cache-based Side-Channel Attacks and Countermeasures

Cache-based side-channel attacks are a critical security threat - they have two distinct phases: (i) identify the security-sensitive addresses (eviction sets) and (ii) reconstruct the cryptographic key by monitoring victim accesses. Although extensive research has focused on complicating the first phase, the second phase, namely key reconstruction, has received less attention. State-of-the-art approaches either take a long time or address a highly reduced version of this problem. The best solution for the AES algorithm requires at least 5 billion attempts, which is impractical. Thus, researchers have focused on simpler algorithms, such as the ECDSA algorithm. We introduce a novel theoretical framework, the $\mathbf{4 R}$ model, to classify countermeasures (CMs) based on their impact on address mappings. We observe that reconstructing the key is quite difficult, as heuristic- and ML-based methods fail under realistic address obfuscation scenarios. To address this challenge, we propose a two-phase attack framework that dynamically adapts to address remapping and noise injection. It employs real-time state validation to overcome dynamic obfuscation mechanisms and retrieve the secret key. Our algorithm is noise-tolerant and efficiently recovers the AES key in roughly 50k attempts with the most sophisticated CMs, demonstrating its robustness and practicality.