sgx-step

A Practical Attack Framework for Precise Enclave Execution Control SGX-Step is an open-source framework to facilitate side-channel attack research on Intel x86 processors in general and Intel SGX platforms in particular. SGX-Step consists of an adversarial Linux kernel driver and a small user-spa...

In-Spectre-Meltdown

In-Spectre-Meltdown This tool allows to check speculative execution side-channel attacks that affect many modern processors and operating systems designs. CVE-2017-5754 Meltdown and CVE-2017-5715 Spectre allows unprivileged processes to steal secrets from privileged processes. These attacks prese...

TID-The-Instant-Destroyer

TID — The Instant Destroyer Independent security research in the field of protection against cache-based side-channel attacks. Overview TID is a specialized protocol designed to eliminate sensitive data remnants such as cryptographic keys from CPU cache layers $L1, L2, \text and L3$ immediately...

fragattacks

FragAttacks: Fragmentation & Aggregation Attacks 1. Introduction This repository contains the FragAttacks tool. It can test Wi-Fi clients and access points for fr agmentation and ag gregation attacks. These vulnerabilities affect all protected Wi-Fi networks. For more information about these...

Mastik

Mastik: A Micro-Architectural Side-Channel Toolkit About Micro-architectural side-channel attacks exploit contention on internal components of the processor to leak information between processes. While in theory such attacks are straightforward, practical implementations tend to be finicky and...

Security update for bouncycastle

This update for bouncycastle fixes the following issues: CVE-2026-17507: negative signed leafindex values from unsigned wire encodings can cause heap exhaustion bsc1284075. CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion bsc1284073. CVE-2026-18036:...

Foundations of Hardware-Software Leakage Contracts

Microarchitectural attacks such as Spectre and Meltdown undermine security by exploiting software-visible side effects of microarchitectural optimizations like caches and speculative execution. To use modern hardware securely, programmers must take into account the security implications of these...

Quantum-Aware Key Rank for Side-Channel Attacks Evaluation

Side-channel attacks on block ciphers rarely recover the key outright: they leave a residual key space ordered by subkey posteriors, and evaluation laboratories report the key rank of the true key against thresholds near 2^48 and 2^60. No evaluation framework models an adversary who collects trac...

Fast Frame Rate Estimation in Electromagnetic Side-Channel Attacks on Public Systems

Frame refresh rate estimation is a fundamental step in identifying compromising harmonic frequencies in electromagnetic side-channel attacks. Methods based on discrete linear autocorrelation DLA are robust across different scenarios and require a computational complexity of $ON\log N$ for a signa...

A Simple Transformer Pipeline for Full-Key Side-Channel Attacks on Uncropped Datasets

Deep learning-based side-channel analysis has historically focused on single-byte targets and manually cropped traces, which risks discarding exploitable leakage. While recent work has proposed specialized architectures and resampling techniques to address this gap, the literature lacks a simple...

Anticipating Decoder Side-Channel Attacks in Fault-Tolerant Quantum Computers

As quantum computing emerges as an applied technology, there is a growing need to protect quantum computers against information security attacks. This work identifies a new class of side-channel attacks against fault-tolerant quantum computers, in which the syndrome data that is sent to the decod...

ARMOR-IMC: Adaptive Resource Mapping for Operational Robustness Via Secure In-Memory Computing

The massive data-movement overhead in traditional architectures has led to the adoption of In-Memory Computing IMC for energy-efficient Deep Neural Network DNN processing. By leveraging emerging devices like Spin-Orbit Torque Magnetic Tunnel Junctions SOT-MTJs, IMC bypasses the "memory wall" and...

WS-2013-0018

Python-rsa is vulnerable to side-channel attacks on decryption and signing...

GitHub Enterprise Server security vulnerabilities

GitHub Enterprise Server is an open-source application developed by GitHub in the United States. It provides a scalable and easy-to-manage platform by allowing users to set their GitHub instances as virtual devices. Prior to version 3.21 of GitHub Enterprise Server, there was a security...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error during the intra-handshake attestation.. An attacker can impersonate a trusted service endpoint and gain unauthorized access to sensitive data or operations by extracting the ephemeral TLS private key through...

Red-Teaming Claude Opus and ChatGPT-Based Security Advisors for Trusted Execution Environments

Trusted Execution Environments TEEs e.g., Intel SGX and ArmTrustZone aim to protect sensitive computation from a compromised operating system, yet real deployments remain vulnerable to microarchitectural leakage, side-channel attacks, and fault injection. In parallel, security teams increasingly...

Trojan-Resilient NTT: Protecting against Control Flow and Timing Faults on Reconfigurable Platforms

Number Theoretic Transform NTT is the most essential component for polynomial multiplications used in lattice-based Post-Quantum Cryptography PQC algorithms such as Kyber, Dilithium, NTRU etc. However, side-channel attacks SCA and hardware vulnerabilities in the form of hardware Trojans may alter...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003848)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003848 advisory. kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of...

CVE-2022-26382

While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox 98...

CVE-2019-18222

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks...