Timerless Side-Channel Attacks

• Timerless side-channel attacks are methods where secret-dependent leakage arises from observable state transitions instead of precise time measurements.
• Researchers exploit microarchitectural artifacts such as memory states, instruction reordering, and speculative cache logic to convert subtle events into exploitable signals.
• Mitigation strategies include interleaving, constant-time repair, and hardware-enforced execution models that balance security with performance.

A timerless side-channel is a class of side-channel attack where the secret-dependent leakage arises from observable state changes or ordering of events in a computing system, but extraction of the leaked information does not require direct access to a fine-grained or high-resolution timer. Timerless side-channels exploit microarchitecturally visible artifacts such as memory states, instruction reordering, hardware resource occupancy, or circuit-level state transitions, converting these artifacts into secret-dependent observables that are accessible even in restricted or virtualized environments where timers are coarse, virtualized, or unavailable.

1. Taxonomy and Definitions

Timerless side-channels differ fundamentally from classical timing side-channels, which rely on measuring absolute or relative durations of certain code regions. In the timerless paradigm, the attacker extracts information from:

• Memory-centric state transitions: E.g., equality detection through deterministic memory encryption or microarchitectural write elision.
• Logical event orderings: E.g., inferring cross-core or cross-thread memory reordering permitted by relaxed memory models.
• Implicit timers in hardware: E.g., software-accessible on-chip delay lines whose sampled output is modulated by side-effects of secret-dependent power usage.
• Instruction-level parallelism artifacts: E.g., the order of independent instruction chains retiring, leaving a durable microarchitectural effect magnifiable by attacker logic.

Timerless side-channels may thus be subdivided into:

Channel Type	Observable	Example Systems
Memory-centric	Equality of writes, silent stores	AMD SEV-SNP, x86 CPUs
Reordering/logical	Memory instructions cross	ARMv8, x86-TSO, modern GPUs
Microarchitectural	State occupation, resource drain	Out-of-order CPUs, SoCs
Physical/electrical	Delay-line register excursions	SoC DLL, programmable delays

Distinguishing them is the absence of any attacker reliance on explicit performance counters or wall-clock access to resolve the leakage (Pätschke et al., 13 Feb 2025, Siddens et al., 13 Jan 2026, Gravellier et al., 2020, Xiao et al., 2022, Kaplan, 2023).

2. Attack Methodologies

Memory-Centric and Write-Equality Leakages

In Trusted Execution Environments (TEEs) and memory systems featuring deterministic block encryption (e.g., AMD SEV-SNP), a ciphertext side-channel arises if repeated writes of identical plaintext to the same physical address produce identical ciphertext in DRAM. An adversary inspecting DRAM contents, or observing silent stores (where a store is elided because its value matches the prior contents), can infer a predicate on secret data without any timing (Pätschke et al., 13 Feb 2025).

Instruction Reordering and Memory DisOrder

A timerless side-channel can be constructed by exploiting relaxed memory consistency models (MCM). In CPUs implementing x86-TSO, ARMv8, or in modern GPUs, instructions such as reads and writes from multiple threads may become globally visible in a re-ordered fashion. By orchestrating litmus test codes (e.g., message-passing tests), and counting the frequency with which forbidden patterns (indicating a reordering) are observed, an attacker can build a covert channel or fingerprint system activity. This approach is effective even when no clock or timer is available; the signal is the prevalence of certain logical orderings (Siddens et al., 13 Jan 2026).

Speculative Cache Logic and Signal Amplification

Speculation-based timerless attacks manipulate microarchitectural state through gadgets such as retpoline-style speculative loops, logic gate primitives (NOT, NAND, NOR), and multi-stage signal amplifiers. An attacker modifies secret-dependent cacheline state and then applies repetitive memory accesses to convert a nanosecond-scale event (cache hit/miss) into a millisecond- or second-scale aggregate effect. The amplified state is then recoverable via coarse, even sleep-based, timers (Kaplan, 2023). These approaches bypass timer coarsening and remain effective in environments where high-resolution time sources have been removed.

Exploitation via Instruction-Level Parallelism

Out-of-order and superscalar processors allow independent chains of instructions to retire in variable order. The relative completion order of such chains, which is a function of secret-dependent computation depths, can encode a secret into cache state or ALU contention patterns. These effects, magnified through custom access patterns, become readable even with coarse timing, or can be chained for repeated amplification. "Hacky Racers"-style methodology, for example, uses racing gadgets and magnifiers to transform subtle ordering differences into large timing gaps (Xiao et al., 2022).

Delay-Line Hardware Exploitation

High-end SoCs with software-accessible delay lines (e.g., Delay-Locked Loops in DDR PHYs, programmable delay-blocks in SD/MMC) permit reading a register value that is actively modulated by supply voltage variation. By sampling this register in synchrony with victim activity, an attacker can recover power-based side-channel information and execute standard power analysis attacks, without ever reading a conventional timer (Gravellier et al., 2020).

3. Detailed Case Studies

Memory DisOrder: Reordering-Based Covert and Fingerprinting Channels

• Attack leverages increased frequency of memory re-orderings when victim or stressor threads are active elsewhere on the chip.
• The attacker runs two threads executing message-passing tests; the prevalence of forbidden memory-access patterns is recorded per run.
• By modulating cross-core memory traffic, a covert channel achieves 16 bits/s at 95% accuracy on Apple M3 GPU, and up to 29 kbits/s on recent x86 CPUs when tuned for parallel broadcasting (Siddens et al., 13 Jan 2026).
• Application fingerprinting can distinguish deep neural network architectures on CPUs and GPUs with >80% accuracy using batches of 100 samples.
• No explicit time measurement is required; the side-channel is statistical, not temporal.

Zebrafix: Interleaving for Ciphertext and Silent Store Protection

• Zebrafix implements a compiler-based tool that instruments all stores of protected data to write a 16-byte vector comprising an 8-byte freshness counter and an 8-byte data field.
• Each write is globally unique; even sequential writes of identical data generate different ciphertext, defeating collision/equality tests and silent store elision.
• The system supports globals, stack, and heap, and uses an accompanying Pin-tool to verify no repeated ciphertext.
• Runtime overhead is ~1.2×, outperforming masking-based countermeasures that incur up to 21× overhead on cryptographic kernels (Pätschke et al., 13 Feb 2025).

Amplification via Speculative Cache Gadgets

• Chained speculative logic primitives amplify cacheline hit/miss differences into observables at macro timescales.
• Amplification loops, using ~23 parallel loads for 300k–700k iterations, create timing signals of 300–900 ms, distinguishable even at 100 ms to 500 ms timer resolution.
• Per-gate accuracy in logic evaluation achieves ≥99.9% for primitive gates; amplification success holds at ≥80% correct recovery with 100 ms timers (Kaplan, 2023).

Hacky Racers: Timerless Extraction on ILP Cores

• Dual-path execution with independent dependency chains creates a microarchitectural race; outcome reflects path depths linked to secret data.
• Magnifier gadgets (e.g., PLRU patterns) exploit cache state changes to amplify the race outcome.
• Effects are readable in environments with only 5 µs–100 ms timer precision; bit rates of ~4 kb/s, per-bit accuracy >88% are demonstrated.
• Many existing Spectre defenses are ineffective; only hardware changes to enforce strictly in-order execution or resource partitioning fundamentally close the channel (Xiao et al., 2022).

Silicon Delay-Lines as Timerless Power Analysis Vectors

• Reading delay-line command registers at MHz sampling rates exposes rapid voltage excursions induced by secret-dependent switching events.
• Full-key recovery of AES-128 in OpenSSL is demonstrated via CPA using 10–40 million traces, without direct timer access.
• Control countermeasures include restricting register access, injecting control-loop noise, and throttling the sample rate (Gravellier et al., 2020).

4. Defenses and Mitigation Strategies

Mitigation of timerless side-channels necessitates closing non-temporal observables or introducing non-determinism:

• Interleaving (Zebrafix) guarantees per-block uniqueness and atomicity, suppressing equality-based and silent-store channels at modest overhead (Pätschke et al., 13 Feb 2025).
• Constant-time program repair statically eliminates secret-dependent cache and instruction timing leakage by balancing branch and memory costs across all inputs (Wu et al., 2018).
• Hardware-enforced execution models (e.g., Ozone) allocate exclusive scratchpad memory and a fixed-cycle thread context, ensuring zero timing and zero microarchitectural state leakage at the expense of resource flexibility (Aweke et al., 2017).
• Memory-fence insertion disables memory-order-based channels but incurs substantial performance cost (2–5×).
• Randomizing/varying cross-process memory access patterns or OS-level obfuscation may reduce the reliability of counting-based timerless side-channels (Siddens et al., 13 Jan 2026).
• Throttling hardware-accessible observation points and introducing jitter/noise into control feedback loops can reduce the signal-to-noise ratio in physical timerless attacks (Gravellier et al., 2020).

All static or dynamic mitigations must balance overhead, coverage, and the persistence of residual side-channels under novel attack methodologies.

5. Performance and Practical Impact

Defense / System	Overhead (typical)	Scope	Channel(s) Closed
Zebrafix (interleaving)	~1.2×	Memory-centric leaks	Ciphertext & silent-store
Program repair (LLVM)	1.05–1.5×	All branches + LUTs	All timing/cache channels
Ozone (hardware thread)	–33 to +30%	All microarch. state	Zero timing capacity
Fence insertion	2–5×	All memory reordering	Memory-order channels

The adoption of timerless side-channels as a practical attack vector has influenced both architectural design and software defense priorities. In scenarios where timer suppression is employed as mitigation against classic side-channel attacks (e.g., browser sandboxing), timerless methodologies restore attacker capabilities, requiring system designers to consider fundamentally timerless leakage modalities.

6. Ongoing Research and Directions

The expansion of timerless side-channel research encompasses exploration of new microarchitectural signals (e.g., store buffer contentions, backend retirement order, implicit power/voltage sensors), empirical enumeration of vulnerabilities in heterogeneous compute nodes, and the development of cross-technology covert and exfiltration channels. Automated detection and mitigation at the compiler and hardware level remain active areas, with static analysis of memory consistency and universality of defense coverage as pivotal challenges. The capacity for attackers to tune and compose signal amplification and channel encoding—without explicit time measurement—suggests the need for formal models that quantify the security of both existing and future timerless defense mechanisms (Siddens et al., 13 Jan 2026, Xiao et al., 2022, Pätschke et al., 13 Feb 2025, Kaplan, 2023, Gravellier et al., 2020, Wu et al., 2018).

---

Main references: (Pätschke et al., 13 Feb 2025, Siddens et al., 13 Jan 2026, Kaplan, 2023, Xiao et al., 2022, Gravellier et al., 2020, Wu et al., 2018, Aweke et al., 2017).