Table Of ContentMMOORRIITTZZ LLIIPPPP
E x p lo i ti n g
M i c r o a r ch i t e c t u ra l
O p ti m i z a ti on s
f r om S o ft wa r e
Illustration
Natascha Eibl
Exploiting Microarchitectural
Optimizations from Software
by
Moritz Lipp
Ph.D. Thesis
Assessors
Daniel Gruss (Graz University of Technology)
Thomas Eisenbarth (University of Lübeck)
August 2021
Institute for Applied Information Processing and Communications
Faculty of Computer Science
Graz University of Technology
iii
AFFIDAVIT
I declare that I have authored this thesis independently, that I have not
used other than the declared sources/resources, and that I have explicitly
indicatedallmaterialwhichhasbeenquotedeitherliterallyorbycontent
from the sources used. The text document uploaded to TUGRAZonline
is identical to the present doctoral thesis.
Date,Signature
Abstract
Withabstractionlayers, theimplementationdetailsofsoftwareandhard-
ware components are hidden away to deal with the complexity of modern
computer systems. While the Instruction Set Architecture (ISA) serves
asaninterfacebetweentheCPUandthesoftwarerunningonit, thecom-
putermicroarchitectureistheactualhardwareimplementationoftheISA.
The clearly defined interfaces do not only cover up the complexity but
also allow different variants of the microarchitecture to be built. While
they all fulfill the contract defined by the ISA, they can differ in other
aspects, suchasperformance, security, energyefficiency, orotherphysical
properties. Microarchitectural attacks exploit these variations occurring
on the microarchitectural level of modern CPUs. With side-channel at-
tacks and fault attacks, there are different ways that allow learning from
and tampering with the actual implementation. These attacks allow ad-
versaries to extract sensitive information processed on the system, e.g.,
cryptographic keys or user behavior.
In this thesis, we expand the landscape of software-based microarchi-
tectural attacks and defenses. By exploring the security implications of
different optimizations, we identify previously unknown attack vectors,
allowing us to circumvent the most fundamental security guarantees of
modern processors. We combine traditional physical side-channel analy-
ses with software-based microarchitectural attack techniques to leak sen-
sitive information processed on the CPU. We enlarge our understanding
of which settings and circumstances facilitate different existing attacks
and give new insights into developing effective and efficient mitigations.
In the first part of this thesis, we discuss the contributions of this thesis
and provide background on CPU architecture and memory organization,
as well as side-channel attacks and fault attacks. Furthermore, we dis-
cuss the state of the art of software-based microarchitectural attacks and
defenses. In the second part, a selection of my peer-reviewed publications
is provided without modification from their original versions.
v
Acknowledgements
Firstandforemost, Iwanttothankmyadvisor, long-timeofficecolleague
and friend, Daniel Gruss, who initially sparked my keen interest in mi-
croarchitectural attacks. While I have always considered side-channel
attacks as black magic and, therefore, have been very reluctant to learn
about them, working with Daniel on my master thesis ignited my fasci-
nation for this research field. I want to thank you for your continuous
support, the freedom you granted me in my research, the endless effort
you invest in everything, and your openness for different opinions.
IwouldespeciallyliketothankMichaelSchwarzforhisfriendship,tireless
support, and ambition to work on all those different projects with me.
I really enjoyed our time working together, discussing all kinds of ideas
whilekeepingthe caffeinelevelat ahealthyhigh, and discoveringpartsof
the world after conferences. I will miss the late-night debugging sessions,
ambitious paper sprints, and presenting our work together.
Looking back over the last years, I want to thank you both, Daniel and
Michael, for this incredible journey. I really enjoyed sharing the office
with you, all the discussions, and the endless effort we put in as a team.
The ups and downs we faced together make this roller coaster ride unfor-
gettable for me.
I want to thank Thomas Eisenbarth for valuable feedback, interesting
discussions and taking the time and effort to assess my thesis.
Furthermore, I would really like to thank Stefan Mangard for giving me
the opportunity to pursue a Ph.D. in the first place. Thank you for your
support and advice over the years.
Over the last couple of years, I had the honor to meet, work and make
friends with incredibly kind and talented people worldwide. While the
list would be endless, I want to especially thank Jo van Bulck and Daniel
Moghimi for insightful discussions and the great teamwork. Likewise, I
want to thank Anders Fogh, David Oswald, Berk Sunar, Julian Steck-
lina, and Thomas Prescher for great discussions and fruitful collabora-
tions. I am further grateful to all my (former) colleagues at the insti-
tute for insightful discussions and for creating such an enjoyable work-
ing environment, in particular, Martin Schwarzl, Claudio Canella, Lukas
Giner, Catherine Easdon, Andreas Kogler, Clémentine Maurice, Robert
vii
viii
Schilling, Mario Werner, Peter Pessl, Stefan More and Sebastian Ra-
macher.
I want to thank my parents, Peter and Michaela, and my siblings, Ilona,
Lukas, and Nikolaus, for all their love and support throughout my en-
tire life. I would like to thank my loving family, Gertraud, Eva, Helga,
Gerhard, Heidrun, and Renate, for their support.
Aspecialthanksgoestoallmyfriends; withouttheirsupport, Icouldnot
have completed this thesis. Thank you for meaningful discussions, even
late at night, and providing the necessary distractions to the working life.
Furthermore, I want to thank Yuki, Rasputin, and my bees for always
helping me to find tranquilness even in the most stressful times.
Finally, I want to be grateful to my better half, Natascha, for her never-
ending supporting love and patience. Thank you for tolerating all follow-
ing deadlines and supporting me throughout all those years. This work
could not have been done without you.
