Intel provides a list with all affected products here.

We disclosed the problem to AMD and ARM as well. However, currently, we are not aware of any official statement regarding affected products from these vendors.

With classical power side-channel attacks, an attacker typically has physical access to a victim device. Using an oscilloscope, the attacker monitors the energy consumption of the device. With interfaces like Intel RAPL, physical access is not required anymore as the measurements can be accessed directly from software. Previous work already showed limited information leakage caused by the Intel RAPL interface. Mantel et al. showed that it is possible to distinguish if different cryptographic keys have been processed by the CPU. Paiva et al. established a covert channel by modulating the energy consumption of the DRAM.

Our research shows that the Intel RAPL interface can be exploited in way more threatening scenarios. We show that in addition to distinguishing different keys, it is possible to reconstruct entire cryptographic keys. We demonstrate this by recovering AES keys from the side-channel resilient AES-NI implementation, as well as RSA keys from an Intel SGX enclave. In addition, we distinguish different Hamming weights of operands or memory loads, threatening constant-time implementations of cryptographic algorithms. To mitigate PLATYPUS, the unprivileged access to the energy consumption has been revoked with an update to the operating system. With Intel SGX, however, a compromised operating system is within the threat model, rendering this mitigation insufficient. Therefore, Intel released microcode updates that change the way the energy consumption is reported if Intel SGX is enabled on the system. Instead of actual energy measurements, it falls back to a model-based approach, such that same instructions with different data or operands can not be distinguished.

Within our research, we focused on Intel's RAPL implementation as the threat model of Intel SGX allows a privileged attacker to achieve a more precise execution control of the victim. However, starting with the Zen microarchitecture, AMD CPUs also provide a RAPL interface that even allows measuring the energy consumption per individual core. With Linux kernel 5.8, this interface also grants access to unprivileged applications, however, currently limited to AMD Rome CPUs.

Furthermore, other processor vendors like ARM and NVIDIA have on-board energy meters that can be used. Marvell and Ampere also provide kernel drivers to provide unprivileged access to hardware sensors. However, as we do not or have only limited access to these devices, we were not able to conduct any experiments on these devices.

On Linux, the powercap framework provides unprivileged access to Intel RAPL by default. On Windows and macOS, the Intel Power Gadget needs to be installed. Therefore, the presented attacks exploiting the unprivileged access only work on Linux.

For a privileged attacker targeting Intel SGX, the operating system used does not matter.

Platypuses are fascinating animals: While they are mammals, they also lay eggs. They have a bill like a duck, a tail like a beaver and a fur like an otter. Males are venomous, but more importantly, they can detect electrical signals with their bill. Likewise to the Platypus that uses its ability to find food even in complete darkness, we sense secrets in the energy measurements of the processor using Intel RAPL.

In addition, PLATYPUS is an acronym for "Power Leakage Attacks: Targeting Your Protected User Secrets".

As the Linux driver provides unrestricited access to the Intel RAPL interface, a security update makes this access privileged.

However, in a setting where the victim is an Intel SGX enclave, this patch does not prevent a compromised operating system from accessing the Intel RAPL counters directly. Therefore, Intel released microcode updates that change the way the energy consumption is reported if Intel SGX is enabled on the system. Instead of actual energy measurements, it falls back to a model-based approach, such that same instructions with different data or operands can not be distinguished. Thus, if the enclave follows the Intel guide lines and uses constant-time cryptographic implementations, an adversary should not be able to recover any secrets of the enclave.

Yes, there is an academic research paper that can be downloaded here.

Additionally, Intel released a Security Advisory that can be accessed here. XEN's security advisory can be accssed here.

Intel Software Guard eXtensions (SGX) is an innovative processor technology released in 2015 to create isolated environments in the computer's memory, so-called enclaves. SGX acts like a secure vault in the processor itself, combining strong encryption and hardware-level isolation to safeguard enclave programs, and the data they operate on, even against very advanced types of malware that compromise the operating system, hypervisor, or firmware (BIOS).

CVE-2020-8694 and CVE-2020-8695 are the official references to PLATYPUS. CVE is the Standard for Information Security Vulnerability Names maintained by MITRE.

The logo is free to use, rights waived via CC0. Logo designed by Natascha Eibl.