## 3 Attacks on AES
### Measurement collection  
The measurement collection process is somehow similar for all the considered techniques. Algorithm 1 summarizes the general method employed to acquire the necessary information about the victim accesses to the tables. This information will be later used to obtain the full key. ```
0: Address(Te0),Address(Te1),Address(Te2),Address(Te3)\(\triangleright\) Addresses of the T-Tables
0:\(\overline{X}_{0}\), \(\overline{X}_{1}\), \(\overline{X}_{2}\), \(\overline{X}_{3}\), \(\overline{S}^{N+1}\)\(\triangleright\) Information about the accesses and ciphertext
1:for\(t=0\) to number of encryptionsdo
2:for\(m=0\) to 4 do\(\triangleright\) INITIALIZATION
3:Evict from cache (Tem);\(\triangleright\) The attacker prepares the cache for the attack
4:endfor\(\triangleright\) WAITING
5:\(\overline{S}^{N+1}\left[t\right]\)=encrypt(random plaintext);\(\triangleright\) The victim performs one encryption
6:for\(m=0\) to 4 do
7: Infer victim accesses to((Tem)\(\triangleright\) RECOVERING
8:if hasAccessed((Tem) then\(\triangleright\) The attacker Reloads, Flushes, Probes the target or gets the Abort
9:\(\overline{X}_{m}\left[t\right]=1\);\(\triangleright\) The attacker decides if the victim has used the data. 10:else
11:\(\overline{X}_{m}\left[t\right]=0\);
12:endif
13:endfor
14:endfor
15:endfor
16:return\(\overline{X}_{0}\), \(\overline{X}_{1}\), \(\overline{X}_{2}\), \(\overline{X}_{3}\), \(\overline{S}^{N+1}\);
```  
**Algorithm 1** Generic attack algorithm for cache attacks against T-Table AES implementations. In the initialization, the attacker has to evict the data of one line of each Te\({}_{i}\) table from the cache. That is, the attacker ensures he knows the state of the cache before the victim uses it. Since each cache line holds 64 bytes, and each entry of the table has 4 bytes, it holds 16 of the 256 possible values of the table. Then, in the waiting stage, he triggers an encryption. Once it has finished, in the recovering stage, the attacker checks the state of the cache. If the cache state has changed, this means that it is likely that the victim had used the data of that T-Table. The different approaches considered in this work differ in the way they evict the data from the cache during the initialization and in the way they recover the information about utilization of the evicted table line. In the initialization stage of _Flush+Something_, the target lines are evicted from the cache using the \(clflush\) instruction available in Intel processors. In _Prime+Something_, the attacker evicts the target lines by accessing the data of the created eviction sets that map to the same region as the target lines. Intel implements a pseudo LRU eviction policy. As a result, accessing \(W\) elements that map to a set implies that any older data in the cache will be replaced with the attacker's data. In _Prime+Abort_, this operation is performed inside a transactional region defined using the Intel TSX extension. In the recovering stage of _Flush+Reload_, the attacker accesses each of the evicted lines measuring the access times. If the time is below a threshold, it means the line was in the cache, so the algorithm must have accessed it in any of the rounds. _Flush+Flush_ decides if the data have been used by measuring the time it takes to flush the line again. The flushing time depends on the presence of the line on the cache; it takes longer to flush data that are located in the cache. The _Prime+Probe_ recovers information on access by accessing the data from the eviction set and measuring the access time. As recommended in previous works [41], we access the data within the eviction set in reverse order in the Probe step. That is, the eviction set is read following a zigzag pattern. If the data of the table are used by the encryption process, part of the attacker's data will be evicted; thus, the time it takes to \"Probe\" the set will be higher. In the _Prime+Abort_, as the eviction set was accessed inside a transaction, any evictionof the attacker's data from the cache causes an abort.