Scheduled Disclosure: Turning Power Into Timing Without Frequency Scaling

Scheduled Disclosure: Turning Power Into Timing Without Frequency Scaling

Speakers: Inwhan Chun; Isabella Siu; Riccardo Paccagnella

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=36I5KwSQ5Ds

Overview

The talk "Scheduled Disclosure: Turning Power Into Timing Without Frequency Scaling" introduces a groundbreaking new class of side-channel attacks that redefines the landscape of remote timing vulnerabilities on modern processors. Presented by Inwhan Chun, Isabella Siu, and Riccardo Paccagnella at IEEE S&P, this research demonstrates that power side-channel information can be converted into observable timing differences, even in the complete absence of traditional frequency scaling mechanisms. This discovery is particularly significant because it bypasses long-standing assumptions about processor power management and challenges the effectiveness of widely adopted security countermeasures, such as constant-time code.

At its core, Scheduled Disclosure exploits a sophisticated hardware optimization found in contemporary Intel x86 architectures, specifically Intel Thread Director. By manipulating workloads to induce varying power consumption, the researchers were able to observe how Thread Director subtly influences the operating system's thread scheduler, leading to power-dependent changes in program execution time. This novel attack vector not only proves that power-to-timing leakage remains feasible on modern hardware, but it also achieves significantly faster cryptographic key recovery compared to previous methods, even from code designed to be constant-time. The implications are profound, demanding a re-evaluation of how system designers and software developers approach side-channel resistance.

Background

▶ Watch: Introduction: Hertzbleed and modern x86 challenges (0:00)

For decades, the security community has grappled with side-channel attacks, where adversaries extract sensitive information by observing physical manifestations of computation, such as power consumption, electromagnetic emissions, or execution time. Among these, remote timing attacks have posed a persistent threat, allowing an attacker to infer secret data by precisely measuring the time taken for a victim's program to execute different operations. While significant research has focused on mitigating both power side-channel attacks and remote timing attacks, a recent vulnerability known as Hertzbleed demonstrated a critical link between the two.

Hertzbleed, discovered prior to Scheduled Disclosure, revealed that on older x86 processors, power side-channel attacks could be transformed into remote timing attacks by exploiting frequency scaling. The mechanism was straightforward: when a workload consumed more power, the processor, to stay within its thermal and power limits, would dynamically lower its operating frequency. This reduction in frequency directly translated to longer program runtime, which could be observed remotely through precise timing analysis. This finding challenged the conventional wisdom that isolated power and timing channels could be independently secured. However, Hertzbleed's effectiveness was primarily demonstrated on older x86 architectures where frequency scaling was often the dominant, if not sole, power management mechanism.

The applicability of Hertzbleed to modern x86 processors remained an open question. Contemporary processors incorporate far more sophisticated and granular power management techniques beyond simple frequency scaling. These include technologies like Intel Speed Shift, Intel Turbo Boost Technology, and complex voltage-frequency optimization algorithms, which aim to dynamically adjust processor performance and power consumption. When similar power-consuming workloads were run on modern x86 processors, researchers observed a crucial difference: there was no observable frequency side-channel leakage. The CPU frequency consistently oscillated around a stable value, regardless of the workload's power consumption. This observation suggested that the direct power-to-frequency-to-timing channel exploited by Hertzbleed might no longer be effective on newer hardware. This led to a critical inquiry: could power still be turned into timing on these advanced processors, and were there other, perhaps more subtle, power management mechanisms creating new, exploitable leakage channels? This is the void that Scheduled Disclosure addresses, demonstrating that indeed, such channels exist and are even more potent.

Key Findings

▶ Watch: Observation 1: Power-dependent idling hints from processor (2:30)

The central discovery presented in this research is that turning power into timing is not only still feasible on modern x86 processors but is also significantly more effective than previous methods, operating entirely in the absence of frequency side-channel leakage. This challenges the prevailing assumption that stable CPU frequencies would eliminate power-derived timing vulnerabilities. The researchers named this new class of side-channel attack Scheduled Disclosure.

The primary mechanism enabling Scheduled Disclosure is Intel Thread Director, a hardware optimization designed to provide hints to the operating system's scheduler. Thread Director aims to intelligently place threads on the most appropriate cores (e.g., performance cores vs. efficiency cores in hybrid architectures) based on their characteristics and the system's current state. While Thread Director provides various types of hints, this research focused specifically on the thread director table component, which reports capabilities of each core, such as its performance and energy efficiency.

The key findings can be summarized as follows:

1. Power-Dependent Idling Hints: The researchers discovered a direct correlation between a workload's power consumption and the hints provided by the processor. When a workload consumes more power, and particularly when the frequency of at least one core drops below a certain threshold (even if overall frequency remains stable), the processor starts reporting "idling hints" for certain cores. These hints essentially mark cores with "all capabilities set to zero," signaling them as idle. Crucially, the more power consumed by a workload, the more frequently and on more initial cores these idling hints are provided. This establishes a direct, power-dependent signal from the hardware.

1. Scheduler Response to Idling Hints: The operating system, specifically Windows (as it's the primary OS currently supporting Intel Thread Director), responds directly to these idling hints. When the processor provides an idling hint for a particular core, the OS scheduler refrains from scheduling any threads on that core, effectively making the core idle. This means that the number of active cores available to a workload becomes dynamically dependent on its power consumption, mediated by Thread Director's hints.

1. Power-Dependent Program Runtime Without Frequency Scaling: The most critical finding is the direct consequence of the above: the power-dependent number of active cores directly translates into differences in program runtime. Higher power consumption leads to more idling hints, fewer cores being utilized by the scheduler, and consequently, a longer program runtime. This entire process occurs even when the frequency of the active cores remains constant and without any observable frequency side-channel leakage, distinguishing it fundamentally from Hertzbleed.

1. Enhanced Attack Efficacy: This new leakage channel enables the recovery of cryptographic keys from constant-time code up to five times faster than previously demonstrated on older x86 processors using Hertzbleed-like techniques. This significant speedup highlights the potent nature of Scheduled Disclosure. The attack is effective even when the frequency of the active cores is constant, underscoring its ability to bypass conventional side-channel protections.

In essence, Scheduled Disclosure leverages a sophisticated hardware optimization intended for performance, Intel Thread Director, to create an unintended side-channel. It reveals that the processor's internal power management, even when not manifested through overt frequency changes, can still influence the OS scheduler in a way that leaks sensitive timing information.

Technical Deep Dive

▶ Watch: Observation 2: OS scheduler uses hints, affecting runtime (3:15)

The technical foundation of Scheduled Disclosure lies in a meticulous reverse engineering methodology applied to modern x86 processors featuring Intel Thread Director. The research team sought to uncover hidden power-dependent system behaviors that could be exploited for timing attacks, specifically focusing on how the processor communicates with the operating system's scheduler.

The methodology involved a multi-pronged approach:

1. Workload Introduction: The researchers created custom workloads composed of multiple threads. These workloads were designed to consume varying amounts of power, allowing for a controlled study of power-dependent system responses. By carefully crafting these workloads, they could induce different power states within the processor.
2. System Monitoring: While these workloads were executing, critical system parameters were measured. These included:

• CPU Frequency: To confirm the absence of frequency side-channel leakage, a key differentiator from Hertzbleed.
• Processor Hints: Direct observation of the hints provided by the processor, specifically those related to Intel Thread Director.
• Operating System Scheduling Behavior: Monitoring how the operating system (OS) interpreted and utilized these hints to schedule threads across the available cores.

1. Target Operating System: The experiments were specifically conducted on Windows, as it was, at the time of the research, the only operating system known to fully support and utilize Intel Thread Director. This ensured that the observed interactions between the hardware hints and the OS scheduler were representative of real-world scenarios.

Through this methodology, two critical observations were made, forming the bedrock of Scheduled Disclosure:

First Observation: Power-Dependent Idling Hints

The researchers observed that when a workload consumed more power, a specific behavior emerged related to Thread Director's output. When the frequency of at least one core, even momentarily or locally, dipped below a certain value—a common occurrence under higher power loads despite overall stable frequencies—the processor began providing what the researchers termed "idling hints." These hints were reported for specific cores, effectively marking them as having "all capabilities set to zero." This signified to the OS that these cores were suitable for idling or had reduced utility. The crucial finding here was the power dependency of these hints: the more power a workload consumed, the more frequently and on a greater number of the initial cores these idling hints appeared. For instance, a high-power workload would cause idling hints to be reported on the first few cores more often than a low-power workload. This established a direct, analog-level leakage channel from the processor's power state to its communication with the OS scheduler.

Second Observation: OS Scheduler's Response to Idling Hints

The second critical observation connected the processor's hints to the OS's behavior. When the processor provided an idling hint for a particular core, the Windows operating system's scheduler responded by not scheduling any threads on that core. Consequently, those cores effectively became idle. Since the provision of these idling hints by the processor is demonstrably power-dependent, it logically follows that how the scheduler utilizes the available cores is also power-dependent.

The Chain of Leakage:

This creates a powerful chain of leakage:

1. Workload Power Consumption (secret-dependent)
2. Processor Internal Power Management (reacts to power consumption)
3. Intel Thread Director Idling Hints (generated based on internal power state, marking cores as idle)
4. Operating System Scheduler Behavior (interprets hints, assigns fewer cores to the workload)
5. Number of Active Cores (reduced for high-power workloads)
6. Program Runtime (longer due to fewer active cores)
7. Remote Timing Attack (observable difference in runtime)

Crucially, the researchers ran additional experiments to measure CPU frequency concurrently with workload execution. The results consistently showed that for each core, the frequency oscillated around the same value, regardless of the workload's power consumption. This empirically confirmed that the observed program runtime differences were indeed power-dependent in the absence of frequency side-channel leakage. This directly distinguishes Scheduled Disclosure from Hertzbleed and similar frequency-based attacks.

The paper also delves into further technical details, such as demonstrating that program runtime remains power-dependent even when the frequency of the cores is entirely constant, and reverse engineering cross-component data leakage when the GPU is active. These additional findings suggest that the principles of Scheduled Disclosure might extend to other components and scenarios within modern heterogeneous computing architectures.

Demo / Proof of Concept

▶ Watch: Security implications: Leaking cryptographic keys faster (4:40)

To validate the practical exploitability and severity of Scheduled Disclosure, the researchers developed a proof-of-concept attack targeting a real-world cryptographic implementation. The chosen target was Cloudflare's cryptographic implementation of Kyber, a post-quantum key encapsulation mechanism (KEM), which was specifically written in constant-time code. Constant-time coding is a widely adopted and crucial mitigation technique against many side-channel attacks, ensuring that the execution path and timing of an operation do not depend on the secret data being processed. The fact that Scheduled Disclosure can successfully attack such an implementation highlights its potency and the inadequacy of existing defenses.

Prior research had already established that bits of a secret key within Kyber's implementation could be inferred by precisely measuring the power consumption during the encapsulation of a specially crafted ciphertext. This forms the basis of a traditional power side-channel attack. Scheduled Disclosure takes this a step further by demonstrating that this power consumption difference can be translated into a remote timing attack, even without direct frequency scaling.

The attack works as follows:

1. Crafted Ciphertext: The attacker provides a specially crafted ciphertext to the victim's Kyber implementation.
2. Power Variation: Depending on the bits of the secret key being processed, the victim's CPU will consume subtly different amounts of power during the cryptographic operation.
3. Thread Director's Response: This variation in processor power consumption directly influences the Intel Thread Director hardware. As detailed in the technical deep dive, higher power consumption triggers Thread Director to provide more "idling hints" to the operating system's scheduler.
4. Scheduler Behavior Change: The operating system, in response to these power-dependent idling hints, allocates fewer active cores to the cryptographic workload.
5. Program Runtime Difference: With fewer cores available, the execution time of the cryptographic operation becomes measurably longer. This difference in runtime is directly correlated with the power consumption, and thus, with the secret key bits.
6. Remote Timing Attack: An attacker, by remotely timing the execution of the Kyber encapsulation operation, can observe these minute differences in runtime. By analyzing these timings across multiple operations with specially chosen inputs, the attacker can progressively infer the secret key bits.

The success of this proof-of-concept is particularly striking due to its performance. The researchers achieved an end-to-end full key recovery five times faster than what had been previously demonstrated on older x86 processors using Hertzbleed-like attacks. This dramatic increase in attack speed underscores the efficiency and severity of Scheduled Disclosure, making it a highly practical threat. The fact that this was accomplished against constant-time code further emphasizes that traditional software-based side-channel mitigations are insufficient against this new class of hardware-rooted vulnerability.

Defensive Implications

▶ Watch: Conclusion: Future mitigations for power-to-timing leakage (5:40)

The discovery of Scheduled Disclosure has profound implications for cybersecurity, fundamentally altering our understanding of side-channel attack surfaces and the efficacy of current mitigation strategies. It demands a re-evaluation of how processors are designed, how operating systems schedule tasks, and how secure software is developed.

The most critical defensive implication is that constant-time code, a cornerstone of cryptographic security for decades, is no longer a sufficient defense against all timing side-channel attacks. Scheduled Disclosure demonstrates that even if an algorithm's execution flow and instruction timings are perfectly constant regardless of secret data, underlying hardware optimizations like Intel Thread Director can introduce secret-dependent timing variations through indirect means. This means that developers must consider not just the logical flow of their code, but also how their code's power consumption interacts with complex, opaque hardware-level power and scheduling mechanisms.

Furthermore, Scheduled Disclosure highlights that analog-level leakage is firmly in scope when considering timing attacks. This refers to subtle, physical characteristics of hardware operation—like power consumption—that can indirectly influence observable timing without direct manipulation of clock frequencies. Future mitigation strategies must account for these deeper, physical layers of leakage, moving beyond purely digital or frequency-based models. This necessitates a shift in focus from solely mitigating direct timing differences to understanding and neutralizing indirect influences on timing that originate from power variations.

For hardware manufacturers like Intel, this research suggests a need to critically examine the security implications of performance-enhancing features like Thread Director. While designed to optimize system efficiency, such features can inadvertently create side channels if their internal state or output (e.g., scheduling hints) is correlated with power consumption in a secret-dependent manner. Potential hardware-level mitigations could include:

• Obscuring Power-Dependent Hints: Modifying Thread Director or similar mechanisms to ensure that the hints provided to the OS scheduler do not reveal fine-grained, power-dependent information that could be correlated with secret data. This might involve introducing noise, quantizing hint values, or decoupling hint generation from immediate power fluctuations.
• Constant-Behavior Hardware: Designing processor features to exhibit constant behavior (in terms of hints or resource allocation) regardless of input-dependent power consumption, similar to how constant-time software aims for constant execution.

For operating system developers, particularly those supporting Intel Thread Director (like Windows), the findings imply a need to review and potentially modify scheduler policies. The OS scheduler currently acts as a passive conduit, directly translating power-dependent hints into resource allocation changes. Potential OS-level mitigations could include:

• Scheduler Hardening: Implementing scheduler policies that are less susceptible to power-dependent hints, perhaps by always allocating a fixed number of cores to sensitive workloads or by introducing randomness in core assignment.
• Power-Aware Scheduling for Security: Developing specific scheduling modes for security-critical applications that prioritize side-channel resistance over pure performance or energy efficiency, even if it means overriding Thread Director's suggestions.

Ultimately, future mitigation efforts must adopt a holistic approach, considering all sources of leakage that turn power into timing, not just the historically emphasized frequency scaling leakage. This requires deeper collaboration between hardware designers, OS developers, and application security engineers to build systems that are robust against these sophisticated, multi-layered side-channel attacks. The industry needs to move towards a security model where the entire stack, from silicon to software, is designed with side-channel resilience in mind, understanding that performance optimizations can inadvertently open new avenues for attack.

Key Takeaways

• Scheduled Disclosure is a new class of timing side-channel attack on modern x86 processors, distinct from previous vulnerabilities like Hertzbleed.
• It exploits Intel Thread Director, a hardware optimization, to turn power consumption differences into observable timing variations.
• The attack works without frequency scaling leakage, demonstrating that power-to-timing conversion is possible even when CPU frequencies remain stable.
• Constant-time code is insufficient for protection, as Scheduled Disclosure bypasses this common mitigation by influencing OS scheduling rather than instruction timings.
• Cryptographic key recovery is significantly faster, achieving end-to-end full key recovery from Kyber's constant-time implementation up to five times faster than prior methods.
• Future mitigations must consider analog-level leakage and all sources that convert power into timing, requiring coordinated efforts across hardware and software layers.

About the Speaker(s)

The talk "Scheduled Disclosure: Turning Power Into Timing Without Frequency Scaling" was presented by Inwhan Chun, with co-authors Isabella Siu and Riccardo Paccagnella. As researchers presenting at the prestigious IEEE S&P conference, their work is at the forefront of computer security and privacy, focusing on identifying and understanding novel vulnerabilities in modern computing architectures. While specific titles and affiliations were not provided in the transcript, their contribution highlights expertise in systems security, microarchitectural attacks, and processor power management.