Hertzbleed: When CPU Power Management Leaks Secrets Through Time

The recently disclosed Hertzbleed attack introduces a novel class of side-channel vulnerability that exploits changes in CPU frequency to leak secret data. Unlike traditional timing attacks that rely on data-dependent instruction execution paths, Hertzbleed demonstrates that the processor's power management system itself, specifically dynamic voltage and frequency scaling (DVFS), can create measurable timing differences based on the data being processed.

For most users, the immediate concern is minimal. The attack's authors note that it does not currently threaten conventional, standardized cryptography used in everyday products and services. The vulnerability is primarily a concern for cryptography engineers, particularly those running SIKE decapsulation servers, which are advised to deploy specific mitigations. The key discovery is that under sustained workloads, DVFS on modern x86 processors behaves differently depending on the data being computed, leading to observable differences in execution time for operations that should theoretically run at the same speed.

How DVFS Works

To understand the vulnerability, it helps to consider how DVFS manages CPU performance. Modern processors feature a power management system that continuously adjusts operating frequency based on workload. The ACPI specification defines performance states (P-states), which are discrete CPU frequency levels incremented in 100 MHz steps. While P0 represents maximum performance, processors often run at a "steady-state frequency" that reflects a balance between performance and power consumption.

Intel processors feature Turbo Boost technology, which permits temporary operation at higher frequencies and power consumption than the Thermal Design Point (TDP) normally allows—useful for short bursts of computation. However, the CPU is designed to run sustained workloads with average power consumption at or below its TDP rating. If a workload underruns the TDP, DVFS reallocates that headroom by allowing the CPU to oscillate between nearby P-states. This oscillation keeps the average power consumption near TDP while maximizing performance.

The concern arises because CPU power consumption is data-dependent. Operations with operands having a high Hamming weight (many bits set) consume more power than those with few bits set. Similar power variations occur when register values change—the Hamming distance between consecutive values affects how many transistor switches occur. The root cause of this Hamming weight effect has been widely observed but lacks a definitive explanation.

Under sustained workloads where the CPU is already capped by TDP, this data-dependent power consumption means workloads with different power profiles will spend different amounts of time at different P-states. When frequency adjusts, execution time changes as well—a program that consumes more power with certain inputs will run at a lower average frequency and therefore take longer to complete.

Vulnerability Paradigm Shift

The principal insight from Hertzbleed is that any workload that varies in power consumption can potentially vary in timing. This conflicts with a core assumption in secure coding practices: constant-time execution. Developers operating on cryptographic protocols typically aim for constant runtime regardless of input data, ensuring that timing measurements don't reveal secret information. This approach has been the standard robust defense against practical timing attacks, including those demonstrated by Kocher, Brumley-Boneh, Lucky13, and others.

Hertzbleed reframes the threat model. Since power analysis and timing analysis become entangled through DVFS, any program vulnerable to power analysis becomes potentially vulnerable to timing analysis as well. If a program handling secret data consumes measurably different power depending on that data, and this translates into timing differences, even constant-time implementations that ignore DVFS effects can be compromised.

SIKE Under Attack

The researchers demonstrated the attack against SIKE (Supersingular Isogeny Key Encapsulation), a Key Encapsulation Mechanism finalist in the NIST Post-Quantum Cryptography competition at Round 3. SIKE relies on the difficulty of computing isogenies (mathematical transformations) between elliptic curves. Given two curves without knowledge of a generating kernel, an attacker should not be able to find the isogeny connecting them—a computational problem believed to be intractable even with a quantum computer.

For performance, SIKE uses Montgomery curves, which allow operations using only the x-coordinate of points expressed as the fraction x = X / Z. These formulas skip the y-coordinate entirely but are not complete: for certain edge-case inputs, formulas fail and produce an output where X=0 and Z=0. This 0/0 result doesn't represent a valid projective point at all.

In SIKE implementations, exceptional inputs trigger a chain reaction where zero coordinates propagate through the rest of the computation, quickly corrupting the result. This domino effect allows an attacker to create queries that reveal key bits. If a guessed bit equals the preceding one, the computation proceeds normally, producing random-looking data. If the guess is wrong, these zero coordinates dominate—and when registers contain all zeros, certain instructions consume less power.

Under CPU stress, this lower power consumption leads DVFS to allow a higher frequency, causing the computation to finish measurably faster. An attacker can distinguish between these two scenarios with repeated queries, bit by bit recovering the secret key. CIRCL, the optimized Go cryptographic library that includes SIKE, was among the targets used by Hertzbleed's authors. Researchers including the Hertzbleed team and De Feo et al., who independently published related findings, worked closely with Cloudflare Research to develop mitigations.

Mitigating Hertzbleed

Best practice guidance for countering Hertzbleed in SIKE deployments begins with robust input validation. Most implementations should not assume that incoming points are well-formed, since malicious actors can craft data that triggers the edge cases. A two-fold validation approach should be used:

  • Input points must be checked to exist on the intended curve with coordinates between 0 and p-1.
  • Points must additionally possess the expected order—similar to preventing small subgroup attacks in Diffie-Hellman cryptography. Multiplying a point by smaller scalars should never yield the identity element if the full order isn't correct.

Validation routines that verify full-order input points prevent crafted data from triggering the cascading-edge-case condition. The cost is modest: approximately 5-10% overhead on SIKE decapsulation, which is an acceptable trade-off for security. These controls are incorporated into CIRCL v1.2.0; projects depended on the library should upgrade promptly.

Wider Implications

Future defense in depth needs to consider power-management systems alongside the conventional attack surface. Hertzbleed represents a new class of side-channel attack that combines previously understood power leakage with processor frequency management to create timing leaks even in algorithms designed to execute in constant time. While SIKE was the specific demonstration, researchers indicate systematic follow-up work examining other cryptographic algorithms may be warranted.

Even without an immediate patch for ordinary users, the wider industry must now account for processor features like DVFS in the constant-time guarantees of secure implementations. Understanding how hardware self-monitors under sustained load is still an active area of discovery, balancing essential performance features against their security implications.