Racing against the clock: side-channel leakage from crossing asynchronous clock domains

Current physical side-channel attacks are based on direct power or electromagnetic measurements, or indirect quantities such as precise measurements of clock jitter. On the other hand, timing side-channel attacks exfiltrate secrets by observing secret-dependent variations in runtime caused by branches or micro-architectural effects, e.g. due to caching. However, little attention has been paid to the fact that power leakage might also manifest architecturally, for example through variations in cycle counts of clock domain crossings, due to the supply-voltage-dependence of the Voltage-Controlled Oscillators within the on-chip Phase-Locked Loop blocks. In this paper, we show that memory and peripherals that operate in a different clock domain to a target processor can be used to indirectly measure power consumption. This allows power side-channel attacks to be performed from software, without privileged access to direct power measurements and using only a cycle counter.We first demonstrate that in a (noisy) x86 environment, it is possible to differentiate between instructions (and instruction operands) based on the variation of cycle counts relative to wall-clock time. For an embedded environment (using an NXP i.MX RT1160-family System-on-Chip (SoC)), we similarly show surprisingly large variations in cycle count correlated with the Hamming weight of data. Based on these observations, we hypothesise a leakage mechanism and present evidence from simulation and a Field Programmable Gate Array-based experiment. We then construct a timing-independent covert channel based on this direct proxy for power consumption on the SoC. Going further, we show that it is possible to recover the private exponent from an RSA modular exponentiation as well as an AES key across a Real-time Operating System thread boundary.