Online template attack (OTA) is a powerful technique previously used to attack elliptic curve scalar multiplication algorithms. This attack has been only analyzed in the realm of power-consumption and EM side-channels, where the signals leak about the value to be processed. However, no microarchitecture analysis variant has been proposed, especially considering the different nature between power-consumption signals and microarchitecture-based ones. In this paper we start filling this gap by revisiting the original OTA description, proposing a generic framework and evaluation metrics for any side-channel signal. Our analysis reveals OTA features not covered before, increasing its application scenarios that requires revisiting original countermeasures to prevent it. In this regard we demonstrate that OTA can work in the backward direction allowing to mount an augmented projective coordinates attack wrt the proposed by Naccache et al. (Eurocrypt 2004). We analyze three libraries libgcrypt, mbedTLS, and wolfSSL using two microarchitecture side-channels. For the libgcrypt case we target its EdDSA implementation using Curve25519 twist curve. We obtain similar results for mbedTLS and wolfSSL with curve secp256r1. For each library we execute extensive attack instances being able to recover the complete scalar in all cases using a single trace. In this work demonstrate that microarchitecture online template attacks are also very powerful in this scenario, recovering secret information without knowing a leakage model. This highlights the importance of developing secure-by-default implementations, instead of fix-on-demand ones.

中文翻译：

---

微架构在线模板攻击

在线模板攻击 (OTA) 是一种强大的技术，以前用于攻击椭圆曲线标量乘法算法。这种攻击仅在功耗和 EM 侧信道领域进行了分析，其中信号泄漏了要处理的值。然而，还没有提出微架构分析变体，特别是考虑到功耗信号和基于微架构的信号之间的不同性质。在本文中，我们通过重新审视原始 OTA 描述开始填补这一空白，为任何侧信道信号提出通用框架和评估指标。我们的分析揭示了以前未涵盖的 OTA 功能，增加了其应用场景，需要重新审视原始对策以防止它。在这方面，我们证明 OTA 可以在反向工作，允许安装由 Naccache 等人提出的增强投影坐标攻击。(Eurocrypt 2004)。我们使用两个微架构侧通道分析了三个库 libgcrypt、mbedTLS 和 wolfSSL。对于 libgcrypt 案例，我们使用 Curve25519 扭曲曲线来定位其 EdDSA 实现。我们使用曲线 secp256r1 为 mbedTLS 和 wolfSSL 获得了类似的结果。对于每个库，我们执行广泛的攻击实例，能够在所有情况下使用单个跟踪恢复完整的标量。在这项工作中，微架构在线模板攻击在这种情况下也非常强大，在不知道泄漏模型的情况下恢复秘密信息。这突出了开发默认安全实现的重要性，