AMD's Secure Encrypted Virtualization (SEV) is a hardware extension available in AMD's EPYC™ server processors to support confidential cloud computing. Although known attacks against SEV, which exploit its lack of encryption in the virtual machine (VM) control block or the lack of integrity protection of the encrypted memory and nested page tables, have been addressed in subsequent releases of SEV-Encrypted State (SEV-ES) and SEV-Secure Nested Paging (SEV-SNP), a new CipherLeaks attack presents a previously unexplored vulnerability for SEV-ES and SEV-SNP. The attack allows a privileged adversary to infer a guest VM's execution states or recover certain plaintext, e.g., to steal private keys from the constant-time implementation of the Rivest-Shamir-Adleman (RSA) algorithm and the Elliptic Curve Digital Signature Algorithm (ECDSA) in the latest OpenSSL library.

The embodiments of the present disclosure relate generally to systems and methods for obfuscating the operation of a device, in particular, timing and power consumption information.

Method and apparatus for protecting against a jitter attack upon a cryptographic processing device. In some embodiments, the cryptographic processing circuit is configured to perform a cryptographic function on a set of input data to generate a corresponding set of transformed output data. An input line supplies an input signal used by the cryptographic processing IC during execution of the cryptographic function. A monitor circuit monitors the input signal, and temporarily disables the cryptographic processing IC when time-varying changes to the input signal indicate a jitter attack may be taking place. The input signal may be a source voltage, and voltage transitions in the source voltage can be monitored. Alternatively, the input signal may be a clock signal, and frequency variations in the clock signal can be monitored. The monitor circuit may be arranged on a power island to maintain power during power fluctuations.

Disclosed herein is a method of accessing a cache, the method comprising: mapping respective physical line addresses (PLAs) of a plurality of PLAs to respective cache locations of a plurality of cache locations in a cache, each PLA of the plurality of PLAs having an associated memory line; encrypting, with a block cipher using a first key, a first PLA of the plurality of PLAs to provide a first encrypted line address (ELA), the first ELA having an associated first encrypted cache location; upon receiving a request to access a first memory line associated with the first PLA, encrypting, using the first key, the first PLA into the first ELA to determine the associated first encrypted cache location; and accessing the first encrypted cache location. Also disclosed herein are systems for implementing the same.

Techniques and apparatuses for detecting and preventing memory attacks are described. In one embodiment, for example, an apparatus may include at least one memory comprising a shared memory and a system memory, logic, at least a portion of the logic comprised in hardware coupled to the at least one shared memory, the logic to implement a memory monitor to determine a memory attack by an attacker application against a victim application using the shared memory, and prevent the memory attack, the memory monitor to determine that victim data is being reloaded into the shared memory from the system memory, store the victim data in a monitor memory, flush shared memory data stored in the shared memory, and write the victim data to the shared memory. Other embodiments are described and claimed.

In one example a computer implemented method comprises encrypting data to be stored in a protected region of a memory using a message authentication code (MAC) having a first value determined using a first key during a first period of time, generating a replay integrity tree structure comprising security metadata for the data stored in the protected region of the memory using the first value of the MAC, and at the end of the first period of time, re-keying the MAC to have a second value determined using a second key at the end of the first period of time, decrypting the data stored in the protected region using the first value for the MAC, re-encrypting the data stored in the protected region using the second value for the MAC, and updating the replay integrity tree using the second value for the MAC. Other examples may be described.

Cryptographic circuitry, in operation, conditionally swaps a first operand and a second operand of a cryptographic operation based on a control value. The conditional swapping includes setting a first mask of a number of bits and a second mask of the number of bits based on the control value, the first mask and the second mask being complementary and having a same Hamming weight. A result of a bitwise XOR operation on the first operand and the second operand is stored as a temporary value. A combination of bitwise logical operations are performed to conditionally swap the first operand and the second operand.

Systems, methods, and devices are disclosed for preventing relay attacks. A user device may receive (e.g., when proximate to the first access device), from an intervening device, device identification data for a first access device. A message may be received from a second access device via the intervening device. The message may include a digital signature generated based at least in part on second access device identification data. The user device may validate the message utilizing the digital signature and a public key. If the message is invalid, the user device may discard the message. If the message is valid, (e.g., unaltered), the user device may determine that the user has not confirmed an intent to interact with the second access device and may terminate an further interaction with the second access device accordingly.

Techniques for mitigating timing attacks via dynamically triggered time dilation are provided. According to one set of embodiments, a computer system can track a count of application programming interface (API) calls or callbacks made by a program within each of a series of time buckets. The computer system can further determine that the count exceeds a threshold count for a predefined consecutive number of time buckets. Upon making this determination, the computer system can trigger time dilation with respect to the program, where the time dilation causes the program to observe a dilated view of time relative to real time.

A method for encrypting data with a provided key. The method includes generating a plurality of keys; processing the data in a plurality of rounds, with each round including: performing a first logical combination of the data with a first key; first permuting the first logically combined data based on a first defined permutation; performing a first substitution on the first permuted data; second permuting the first substituted data based on a second defined permutation; performing a second logical combination of the second permuted data with a permuted second key; and performing a second substitution on the second logically combined data. Further, performing a penultimate logical combination of the second substituted data with a penultimate key, permuting the penultimate logically combined data, performing a final substitution of the permuted data, and performing a final logical combination of the final substituted data with a last key.