CryptoBTB: a secure hierarchical BTB for diverse instructionfootprint workloads

Conference item

Timing attacks leveraging shared resources on a CPU are a growing concern. Branch Target Buffer (BTB), a crucial component of high-performance processors, is shared among threads and privileged spaces. Recently, researchers discovered numerous vulnerabilities in the BTB, allowing an adversary to maliciously infer a victim’s BTB update and mistrain the BTB. Such attacks can successfully bypass privilege-level and secure enclave protection, as well as address space isolation. Randomizing BTB through encrypted addressing to prevent these attacks suffers from high performance overhead due to exposed encryption latency in the pipeline. Prior works address this by using encryption schemes that are either not fully secure or require frequent flush. The most recent proposal, HyBP [79], uses stronger encryption schemes. However, it suffers from high overhead since it underutilizes the BTB and suffers from higher collisions within the same thread.

In this work, we propose CryptoBTB, a secure BTB, specifically designed for an exclusive BTB hierarchy. Our proposal decouples the index encryption from the index itself, enabling low-latency index encryption to obscure BTB set mapping. Additionally, unlike earlier secure BTB proposals, this scheme is well-suited for applications with a higher instruction footprint where performance is sensitive to the BTB capacity. We evaluated CryptoBTB on various classes of workloads that stress the BTB differently. Our results show that CryptoBTB incurs 4.27% performance overhead for these workloads, while HyBP experiences 31.89% overhead. Moreover, CryptoBTB requires 22.57% lower hardware overhead than HyBP.

Authors: Adak, D; Rotenberg, E; Awad, AMRO; Zhou, H

• Publication status: Published
• Peer review status: Peer reviewed
• Publisher: Association for Computing Machinery
• Host title: MICRO '25: Proceedings of the 58th IEEE/ACM International Symposium on Microarchitecture
• Pages: 1087-1101
• Publication date: 2025-10-17
• Acceptance date: 2025-07-14
• Event title: 58th IEEE/ACM International Symposium on Microarchitecture® (MICRO 2025)
• Event location: Seoul, Korea
• Event website: https://www.microarch.org/micro58/
• Event start date: 2025-10-18
• Event end date: 2025-10-22
• DOI: 10.1145/3725843.3756050
• EISBN: 9798400715730
• Language: English
• Keywords: branch target; buffer side-channel