## 5 Experimental Proof of Two Cache Timing Attacks
### Cache Timing Side-Channel Attacks
#### 5.1.4 Evict+Time  
The _Evict+Time_ attack we implemented only targets the first round of the _AES-128 T-table_. In this scenario, we also performed a pre-profiling step to find a threshold that differentiates between the execution time of a plaintext encryption process with the \(T_{0}\) elements present in the cache and without. The main steps of our scenario of _Evict+Time_ attack are as follows:  
* Step 1: The malicious master interface triggers the execution of plaintext encryption in the processing system. Like in the first attack, all plaintexts use a fixed \(p_{i}\) byte. This first step loads the elements of \(T_{0}\) table necessary for the encryption onto the cache. * Step 2: The master interface evicts the cache line containing an element from the \(T_{0}\). * Step 3: The master interface again triggers the encryption of the same plaintext as that used in step 1. During this step, the cipher only loads the cache with the missing elements needed to perform the encryption. If the element of table \(T_{0}\) evicted in step 2 is needed during the encryption, the cipher algorithm will load it from the external memory. This load operation adds some clock cycles to the execution time of the encryption process. * Step 4: This step is executed at the same time as step 3. The master interface measures the time between the initiation of the encryption and the reception of the ciphertext. If the encryption time is above the threshold fixed during the pre-profiling step, the master interface can deduce that the element evicted in step 2 was used during the encryption process and then find the byte \(k_{i}\) in the key. Like in the _Flush+Reload_ attack, the four steps need to be run 256 \(\cdot\) 256 times to get the byte \(k_{0}\). Figure 11 shows the cache access pattern of the \(T_{0}\) table using _Evict+Time_ from the programmable logic part. The pattern in the figure reveals that \(k_{0}\) = 0 \(\times\) 51. Cover Channel Attack Exploiting Cache Coherency between the Programmable Logic and the Processing System  
In this section, we introduce for the first time a covert channel attack between the programmable logic and the processing system of an SoC-FPGA. The secure world of  
Figure 11: Cache access pattern to \(T_{0}\) table using a _Evict+Time_ attack from the programmable logic part, frequency = 250 MHz. the processing system includes a spy process that uses _Flush+Reload_ attack software to communicate with the receiver process, i.e., the malicious master interface used previously. The malicious interface uses our method to distinguish between a cache miss and cache hit. In this scenario, we assume that the spy and the receiver process are not allowed to communicate directly. The two processes use a shared memory address located in a secure region of the external memory to communicate. This address is only readable by the receiving process but is both readable and writeable by the spy process. The spy process uses Algorithm 1 to send a logical _'0'_ and _'1'_. Algorithm 1 uses the flush technique presented in [13]. To transmit a logical _'1'_, the spy process flushes the shared address from the cache and sleeps for a period _Time_1_. To transmit a logical _'0'_, the spy process flushes the shared address from the cache and sleeps for a period _Time_2_. _Time_1_ is longer than _Time_2_. Between two successive bits sent, the spy process loads the data in the cache and sleeps for a period, _Time_3_. The choice of the period _Time_1_, _Time_2_ and _Time_3_ has a significant impact on the bandwidth and the error rate of the covert channel. ```
Input: address, data_to_transfer For i=data_to_transfer_ size To 0 Do  If (data_to_transfer[i] = 1) then  Flush(address)  Usleep(Time_1)  Else  Flush(address)  Usleep(Time_2)  End if  Access(address)  Usleep(Time_3)  End For
```  
**Algorithm 1**Encoding of data by the spy process  
To decode the transmitted data, the receiving process continuously issues a coherent read request targeting the shared address to measure access time.