Presentation
BREW-RC: Bit-Exact Recovery of ECCs from Write Timing in ReRAM Crossbars
DescriptionWe present BREW-RC, a non-invasive technique that uses a timing side channel to reverse engineer error-correcting codes (ECCs) in ReRAM crossbar memories. ECCs use a parity submatrix to extend data words with parity bits, forming codewords. These parity bits cannot be read directly, but BREW-RC reveals them by using write latency variability to determine the aggregate polarity of codeword transitions. Timing perturbations caused by ECC parity bit updates are encoded as a SAT instance whose solution yields the bit-exact parity matrix. Knowledge of the parity matrix enables: (1) improved timing models for side-channel attacks/mitigations and latency-sensitive applications, and (2) ECC-aware reliability characterization of devices whose error correction capabilities are unadvertised. We demonstrate BREW-RC on two commercial ReRAM products, recovering the complete ECC from multiple samples of each.
Event Type
Research Manuscript
TimeTuesday, July 2812:03pm - 12:16pm PDT
LocationMtg Room 203C