Portable method reveals hidden computer timing delays without clocks
PhotoFinish: Portable Timerless Probing of Microarchitectural Latencies
Cryptography and Security
Summary
Measuring tiny delays inside a computer helps find hidden clues about how it works or is being attacked. The authors found a way to do this without using clocks or timers, which are often blocked to stop spying. Instead, their method uses two parts of a program racing to write to the same place, turning invisible delays into something the computer can see directly. This approach works on many types of computers, even inside web browsers, and can detect details like cache states and security vulnerabilities.
What this means in practice
- •For security engineers: Detect microarchitectural vulnerabilities without relying on timers, improving side-channel attack analysis in constrained environments like browsers.
- •For browser developers: Evaluate and strengthen browser defenses by testing how code can observe hidden hardware timing even when high-resolution timers are blocked.
Authors
Tristan Hornetz, Eduard Ebert, Lorenz Hetterich, Lukas Gerlach, Michael Schwarz
Abstract
Timing measurements are a fundamental building block of microarchitectural attacks, enabling software to convert otherwise invisible latency differences into architectural observations. Thus, restricting high-resolution timers is a common defense, especially in constrained environments such as web browsers. Timerless probing primitives provide an alternative approach. Instead of reading or constructing a timer, they observe architectural events that correlate with the microarchitectural state. However, such primitives typically rely on platform-specific behavior, and none generalizes across the wider computing landscape. In this paper, we present PhotoFinish, a portable timerless probing primitive that converts latency differences directly into an architectural value. PhotoFinish races an operation under test against a fixed reference in two parallel threads that then write unique values to the same shared location, resulting in a latency-dependent architectural value. PhotoFinish only requires parallel execution and shared memory, without constructing or reading a clock. We evaluate PhotoFinish on 38 CPUs spanning four ISAs and demonstrate reliable cache state classification across widely different microarchitectures, with comparable fidelity when compiled to WebAssembly and executed inside a browser. We further use PhotoFinish in AES T-table and Evict+Reload attacks, show that it applies beyond caches to TLB and execution-engine latencies, and demonstrate sufficient precision to identify the LLC slice of an address. Our results demonstrate shared-memory races as a generic and precise replacement for explicit timing, showing that restricting timers alone does not prevent software from observing fine-grained microarchitectural latency differences.