\begin{thebibliography}{196}
\providecommand{\natexlab}[1]{#1}
\providecommand{\url}[1]{\texttt{#1}}
\expandafter\ifx\csname urlstyle\endcsname\relax
  \providecommand{\doi}[1]{doi: #1}\else
  \providecommand{\doi}{doi: \begingroup \urlstyle{rm}\Url}\fi

\bibitem[nis(2011)]{nist2011fipscert}
\emph{{FIPS 140-2} Consolidated Validation Certificate {No. 0003}}.
\newblock 2011.

\bibitem[nis(2012)]{nist2015ibm4765}
\emph{{IBM 4765} Cryptographic Coprocessor Security Module - Security Policy}.
\newblock Dec 2012.

\bibitem[7zi(2014)]{7zip2014haswell}
{7-Zip} {LZMA} benchmark: {Intel} {Haswell}.
\newblock \url{http://www.7-cpu.com/cpu/Haswell.html}, 2014.
\newblock [Online; accessed 10-Februrary-2015].

\bibitem[cve(2014{\natexlab{a}})]{cvedetails2014linux}
{Linux} kernel: {CVE} security vulnerabilities, versions and detailed reports.
\newblock
  \url{http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33},
  2014{\natexlab{a}}.
\newblock [Online; accessed 27-April-2015].

\bibitem[cve(2014{\natexlab{b}})]{cvedetails2014xen}
{XEN}: {CVE} security vulnerabilities, versions and detailed reports.
\newblock
  \url{http://www.cvedetails.com/product/23463/XEN-XEN.html?vendor_id=6276},
  2014{\natexlab{b}}.
\newblock [Online; accessed 27-April-2015].

\bibitem[fit(2014)]{fitpc2014mehw}
{IPC2} hardware specification.
\newblock
  \url{http://fit-pc.com/download/intense-pc2/documents/ipc2-hw-specification.pdf},
  Sep 2014.
\newblock [Online; accessed 2-Dec-2015].

\bibitem[goo(2014)]{google2014sha1deprecation}
Gradually sunsetting {SHA-1}.
\newblock
  \url{http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html},
  2014.
\newblock [Online; accessed 4-May-2015].

\bibitem[nis(2014)]{nist2014sha1policy}
{NIST'S} policy on hash functions.
\newblock \url{http://csrc.nist.gov/groups/ST/hash/policy.html}, 2014.
\newblock [Online; accessed 4-May-2015].

\bibitem[pur(2014)]{purism2014meclock}
{BIOS} freedom status.
\newblock \url{https://puri.sm/posts/bios-freedom-status/}, Nov 2014.
\newblock [Online; accessed 2-Dec-2015].

\bibitem[xen(2015)]{xen2015loc}
{Xen} project software overview.
\newblock \url{http://wiki.xen.org/wiki/Xen_Project_Software_Overview}, 2015.
\newblock [Online; accessed 27-April-2015].

\bibitem[mic(2016)]{microsoft2014sha1deprecation}
{SHA-1} deprecation countdown.
\newblock
  \url{https://blogs.windows.com/msedgedev/2016/11/18/countdown-to-sha-1-deprecation/#MPDwCxdpw3IqPPBR.97},
  2016.
\newblock [Online; accessed 18-June-2017].

\bibitem[Abraham(2006)]{abraham2006repmov}
Seth Abraham.
\newblock Time to revisit {REP;MOVS} - comment.
\newblock \url{https://software.intel.com/en-us/forums/topic/275765}, Aug 2006.
\newblock [Online; accessed 23-January-2015].

\bibitem[Alves and Felton(2004)]{alves2004trustzone}
Tiago Alves and Don Felton.
\newblock {TrustZone}: Integrated hardware and software security.
\newblock \emph{Information Quarterly}, 3\penalty0 (4):\penalty0 18--24, 2004.

\bibitem[Anati et~al.(2013)Anati, Gueron, Johnson, and Scarlata]{anati2013sgx}
Ittai Anati, Shay Gueron, Simon~P. Johnson, and Vincent~R. Scarlata.
\newblock Innovative technology for {CPU} based attestation and sealing.
\newblock In \emph{Proceedings of the 2nd International Workshop on Hardware
  and Architectural Support for Security and Privacy, HASP}, volume~13, 2013.

\bibitem[Anderson(2001)]{anderson2001security}
Ross Anderson.
\newblock \emph{Security engineering: A guide to building dependable
  distributed systems}.
\newblock Wiley, 2001.

\bibitem[Anthony(2014)]{anthony2014linuxsize}
Sebastian Anthony.
\newblock Who actually develops {Linux}? the answer might surprise you.
\newblock
  \url{http://www.extremetech.com/computing/175919-who-actually-develops-linux},
  2014.
\newblock [Online; accessed 27-April-2015].

\bibitem[ARM(2004)]{arm2004ambaxi}
\emph{{AMBA}{\textregistered} {AXI} Protocol}.
\newblock ARM Limited, Mar 2004.
\newblock Reference no. IHI 0022B, IHI 0024B, AR500-DA-10004.

\bibitem[ARM(2009)]{arm2009trustzone}
\emph{{ARM} Security Technology Building a Secure System using
  {TrustZone}{\textregistered} Technology}.
\newblock ARM Limited, Apr 2009.
\newblock Reference no. PRD29-GENC-009492C.

\bibitem[Banescu(2011)]{banescu2011cache}
Sebastian Banescu.
\newblock Cache timing attacks.
\newblock 2011.
\newblock [Online; accessed 26-January-2014].

\bibitem[Barker et~al.(2012)Barker, Barker, Burr, Polk, and
  Smid]{fips2012keysize}
Elaine Barker, William Barker, William Burr, William Polk, and Miles Smid.
\newblock Recommendation for key management -- part 1: General (revision 3).
\newblock \emph{Federal Information Processing Standards (FIPS) Special
  Publications (SP)}, 800-57, Jul 2012.

\bibitem[Barker et~al.(2015)Barker, Barker, Burr, Polk, and Smid]{fips2015shs}
Elaine Barker, William Barker, William Burr, William Polk, and Miles Smid.
\newblock Secure hash standard ({SHS}).
\newblock \emph{Federal Information Processing Standards (FIPS) Publications
  (PUBS)}, 180-4, Aug 2015.

\bibitem[Beck(1998)]{beck1998integrated}
Friedrich Beck.
\newblock \emph{Integrated Circuit Failure Analysis: a Guide to Preparation
  Techniques}.
\newblock John Wiley \& Sons, 1998.

\bibitem[Bleichenbacher(1998)]{bleichenbacher1998pkcs1v15cca}
Daniel Bleichenbacher.
\newblock Chosen ciphertext attacks against protocols based on the {RSA}
  encryption standard {PKCS}\# 1.
\newblock In \emph{Advances in Cryptology -- CRYPTO'98}, pages 1--12. Springer,
  1998.

\bibitem[Boggs and Rodgers(1997)]{intel1997events}
D.~D. Boggs and S.~D. Rodgers.
\newblock Microprocessor with novel instruction for signaling event occurrence
  and for providing event handling information in response thereto, 1997.
\newblock US Patent 5,625,788.

\bibitem[Bonneau and Mironov(2006)]{bonneau2006aes}
Joseph Bonneau and Ilya Mironov.
\newblock Cache-collision timing attacks against {AES}.
\newblock In \emph{Cryptographic Hardware and Embedded Systems-CHES 2006},
  pages 201--215. Springer, 2006.

\bibitem[Brickell and Li(2009)]{brickell2009epid}
Ernie Brickell and Jiangtao Li.
\newblock Enhanced privacy {ID} from bilinear pairing.
\newblock \emph{IACR Cryptology ePrint Archive}, 2009.

\bibitem[Brumley and Tuveri(2011)]{brumley2011ecc}
Billy~Bob Brumley and Nicola Tuveri.
\newblock Remote timing attacks are still practical.
\newblock In \emph{Computer Security--ESORICS 2011}, pages 355--371. Springer,
  2011.

\bibitem[Brumley and Boneh(2005)]{brumley2005rsa}
David Brumley and Dan Boneh.
\newblock Remote timing attacks are practical.
\newblock \emph{Computer Networks}, 48\penalty0 (5):\penalty0 701--716, 2005.

\bibitem[Butterworth et~al.(2013)Butterworth, Kallenberg, Kovah, and
  Herzog]{butterworth2013bios}
John Butterworth, Corey Kallenberg, Xeno Kovah, and Amy Herzog.
\newblock {BIOS} chronomancy: Fixing the core root of trust for measurement.
\newblock In \emph{Proceedings of the 2013 ACM SIGSAC conference on Computer \&
  Communications Security}, pages 25--36. ACM, 2013.

\bibitem[Champagne and Lee(2010)]{champagne2010bastion}
David Champagne and Ruby~B. Lee.
\newblock Scalable architectural support for trusted software.
\newblock In \emph{High Performance Computer Architecture (HPCA), 2010 IEEE
  16th International Symposium on}, pages 1--12. IEEE, 2010.

\bibitem[Chen and Ahn(2014)]{chen2014microcode}
Daming~D. Chen and Gail-Joon Ahn.
\newblock Security analysis of x86 processor microcode.
\newblock 2014.
\newblock [Online; accessed 7-January-2015].

\bibitem[Chen et~al.(2011)Chen, Mao, Wang, Zhou, Zeldovich, and
  Kaashoek]{chen2011linux}
Haogang Chen, Yandong Mao, Xi~Wang, Dong Zhou, Nickolai Zeldovich, and M.~Frans
  Kaashoek.
\newblock {Linux} kernel vulnerabilities: State-of-the-art defenses and open
  problems.
\newblock In \emph{Proceedings of the Second Asia-Pacific Workshop on Systems},
  page~5. ACM, 2011.

\bibitem[Chen(2009)]{fips2009kdf}
Lily Chen.
\newblock Recommendation for key derivation using pseudorandom functions.
\newblock \emph{Federal Information Processing Standards (FIPS) Special
  Publications (SP)}, 800-108, Oct 2009.

\bibitem[Coreboot(2014)]{coreboot2015manual}
Coreboot.
\newblock Developer manual, Sep 2014.
\newblock [Online; accessed 4-March-2015].

\bibitem[Cornaby and Chaffin(2007)]{intel2007microstack}
M.~P. Cornaby and B.~Chaffin.
\newblock Microinstruction pointer stack including speculative pointers for
  out-of-order execution, 2007.
\newblock US Patent 7,231,511.

\bibitem[Corporation(2014)]{intel2014uncore}
Intel Corporation.
\newblock \emph{{Intel}{\textregistered} {Xeon}{\textregistered} Processor {E5}
  v3 Family Uncore Performance Monitoring Reference Manual}, Sep 2014.
\newblock Reference no. 331051-001.

\bibitem[Costan et~al.(2015)Costan, Lebedev, and Devadas]{costan2015sanctum}
Victor Costan, Ilia Lebedev, and Srinivas Devadas.
\newblock Sanctum: Minimal hardware extensions for strong software isolation.
\newblock Cryptology ePrint Archive, Report 2015/564, 2015.

\bibitem[Costan et~al.(2017)Costan, Lebedev, and Devadas]{part2}
Victor Costan, Ilia Lebedev, and Srinivas Devadas.
\newblock Secure processors part {II}: {Intel} {SGX} security analysis and
  {MIT} sanctum architecture.
\newblock In \emph{FnTEDA}, 2017.

\bibitem[Daemen and Rijmen(1999)]{daemen1999aes}
J.~Daemen and V.~Rijmen.
\newblock {AES} proposal: Rijndael, {AES} algorithm submission, Sep 1999.

\bibitem[Datta and Kumar(2013)]{datta2013acm}
S.~M. Datta and M.~J. Kumar.
\newblock Technique for providing secure firmware, 2013.
\newblock US Patent 8,429,418.

\bibitem[Datta et~al.(2010)Datta, Zimmer, and Rothman]{datta2010trustedboot}
S.~M. Datta, V.~J. Zimmer, and M.~A. Rothman.
\newblock System and method for trusted early boot flow, 2010.
\newblock US Patent 7,752,428.

\bibitem[Dice(2011)]{dice2011meclock}
Pete Dice.
\newblock Booting an {Intel} architecture system, part i: Early initialization.
\newblock \emph{Dr. Dobb's}, Dec 2011.
\newblock [Online; accessed 2-Dec-2015].

\bibitem[Diffie and Hellman(1976)]{diffie1976keyexchange}
Whitfield Diffie and Martin~E. Hellman.
\newblock New directions in cryptography.
\newblock \emph{Information Theory, IEEE Transactions on}, 22\penalty0
  (6):\penalty0 644--654, 1976.

\bibitem[Duflot et~al.(2006)Duflot, Etiemble, and Grumelard]{duflot2006smm}
Lo{\"\i}c Duflot, Daniel Etiemble, and Olivier Grumelard.
\newblock Using {CPU} system management mode to circumvent operating system
  security functions.
\newblock \emph{CanSecWest/core06}, 2006.

\bibitem[Dworkin(2001)]{fips2001ctr}
Morris Dworkin.
\newblock Recommendation for block cipher modes of operation: Methods and
  techniques.
\newblock \emph{Federal Information Processing Standards (FIPS) Special
  Publications (SP)}, 800-38A, Dec 2001.

\bibitem[Dworkin(2005)]{fips2005cmac}
Morris Dworkin.
\newblock Recommendation for block cipher modes of operation: The {CMAC} mode
  for authentication.
\newblock \emph{Federal Information Processing Standards (FIPS) Special
  Publications (SP)}, 800-38B, May 2005.

\bibitem[Dworkin(2007)]{fips2017gcm}
Morris Dworkin.
\newblock Recommendation for block cipher modes of operation: Galois/counter
  mode ({GCM}) and {GMAC}.
\newblock \emph{Federal Information Processing Standards (FIPS) Special
  Publications (SP)}, 800-38D, Nov 2007.

\bibitem[Eastlake and Jones(2001)]{eastlake2001sha1}
D.~Eastlake and P.~Jones.
\newblock {{RFC 3174}: {US} Secure Hash Algorithm 1 ({SHA1})}.
\newblock \emph{Internet RFCs}, 2001.

\bibitem[Embleton et~al.(2010)Embleton, Sparks, and Zou]{embleton2010smm}
Shawn Embleton, Sherri Sparks, and Cliff~C. Zou.
\newblock {SMM} rootkit: a new breed of {OS} independent malware.
\newblock \emph{Security and Communication Networks}, 2010.

\bibitem[Ferguson et~al.(2011)Ferguson, Schneier, and
  Kohno]{ferguson2011crypto}
Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno.
\newblock \emph{Cryptography Engineering: Design Principles and Practical
  Applications}.
\newblock John Wiley \& Sons, 2011.

\bibitem[Fletcher et~al.(2012)Fletcher, Dijk, and Devadas]{fletcher2012ascend}
Christopher~W. Fletcher, Marten~van Dijk, and Srinivas Devadas.
\newblock A secure processor architecture for encrypted computation on
  untrusted programs.
\newblock In \emph{Proceedings of the Seventh ACM Workshop on Scalable Trusted
  Computing}, pages 3--8. ACM, 2012.

\bibitem[Fog(2014)]{fog2014microops}
Agner Fog.
\newblock Instruction tables - lists of instruction latencies, throughputs and
  micro-operation breakdowns for {Intel}, {AMD} and {VIA} {CPU}s.
\newblock Dec 2014.
\newblock [Online; accessed 23-January-2015].

\bibitem[Furtak et~al.(2014)Furtak, Bulygin, Bazhaniuk, Loucaides, Matrosov,
  and Gorobets]{furtak2014bios}
Andrew Furtak, Yuriy Bulygin, Oleksandr Bazhaniuk, John Loucaides, Alexander
  Matrosov, and Mikhail Gorobets.
\newblock {BIOS} and secure boot attacks uncovered.
\newblock \emph{The 10th ekoparty Security Conference}, 2014.
\newblock [Online; accessed 22-October-2015].

\bibitem[Futral and Greene(2013)]{futral2013servertxt}
William Futral and James Greene.
\newblock \emph{{Intel}{\textregistered} Trusted Execution Technology for
  Server Platforms}.
\newblock Apress Open, 2013.

\bibitem[Gassend et~al.(2002)Gassend, Clarke, Van~Dijk, and
  Devadas]{gassend2002puf}
Blaise Gassend, Dwaine Clarke, Marten Van~Dijk, and Srinivas Devadas.
\newblock Silicon physical random functions.
\newblock In \emph{Proceedings of the 9th ACM Conference on Computer and
  Communications Security}, pages 148--160. ACM, 2002.

\bibitem[Gassend et~al.(2003)Gassend, Suh, Clarke, Van~Dijk, and
  Devadas]{gassend2003merkle}
Blaise Gassend, G.~Edward Suh, Dwaine Clarke, Marten Van~Dijk, and Srinivas
  Devadas.
\newblock Caches and hash trees for efficient memory integrity verification.
\newblock In \emph{Proceedings of the 9th International Symposium on
  High-Performance Computer Architecture}, pages 295--306. IEEE, 2003.

\bibitem[Genkin et~al.(2013)Genkin, Shamir, and Tromer]{genkin2014rsa}
Daniel Genkin, Adi Shamir, and Eran Tromer.
\newblock {RSA} key extraction via low-bandwidth acoustic cryptanalysis.
\newblock Cryptology ePrint Archive, Report 2013/857, 2013.

\bibitem[Genkin et~al.(2014)Genkin, Pipman, and Tromer]{genkin2014fullpa}
Daniel Genkin, Itamar Pipman, and Eran Tromer.
\newblock Get your hands off my laptop: Physical side-channel key-extraction
  attacks on pcs.
\newblock Cryptology ePrint Archive, Report 2014/626, 2014.

\bibitem[Genkin et~al.(2015)Genkin, Pachmanov, Pipman, and
  Tromer]{genkin2015radiopa}
Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer.
\newblock Stealing keys from {PCs} using a radio: Cheap electromagnetic attacks
  on windowed exponentiation.
\newblock Cryptology ePrint Archive, Report 2015/170, 2015.

\bibitem[Gentry(2009)]{gentry2009fhe}
Craig Gentry.
\newblock \emph{A fully homomorphic encryption scheme}.
\newblock PhD thesis, Stanford University, 2009.

\bibitem[George et~al.(2009)George, Brandt, Venkatraman, and
  Kim]{intel2009pipeline}
R.~T. George, J.~W. Brandt, K.~S. Venkatraman, and S.~P. Kim.
\newblock Dynamically partitioning pipeline resources, 2009.
\newblock US Patent 7,552,255.

\bibitem[Glew et~al.(1997)Glew, Hinton, and Akkary]{intel1997pmh}
A.~Glew, G.~Hinton, and H.~Akkary.
\newblock Method and apparatus for performing page table walks in a
  microprocessor capable of processing speculative instructions, 1997.
\newblock US Patent 5,680,565.

\bibitem[Glew et~al.(1996)Glew, Akkary, Colwell, Hinton, Papworth, and
  Fetterman]{intel1996dtlb}
A.~F. Glew, H.~Akkary, R.~P. Colwell, G.~J. Hinton, D.~B. Papworth, and M.~A.
  Fetterman.
\newblock Method and apparatus for implementing a non-blocking translation
  lookaside buffer, 1996.
\newblock US Patent 5,564,111.

\bibitem[Goldreich(1987)]{goldreich1987oram}
Oded Goldreich.
\newblock Towards a theory of software protection and simulation by oblivious
  {RAM}s.
\newblock In \emph{Proceedings of the 19th annual ACM symposium on Theory of
  Computing}, pages 182--194. ACM, 1987.

\bibitem[Goodman and Hum(2009)]{goodman2009mesif}
J.~R. Goodman and H.~H.~J. Hum.
\newblock {MESIF}: A two-hop cache coherency protocol for point-to-point
  interconnects.
\newblock 2009.

\bibitem[Grand(2004)]{grand2004physicalattacks}
Joe Grand.
\newblock Advanced hardware hacking techniques, Jul 2004.

\bibitem[Grawrock(2009)]{grawrock2009txt}
David Grawrock.
\newblock \emph{Dynamics of a Trusted Platform: A building block approach}.
\newblock Intel Press, 2009.

\bibitem[Gruss et~al.(2015)Gruss, Maurice, and Mangard]{gruss2015rowhammer}
Daniel Gruss, Cl{\'e}mentine Maurice, and Stefan Mangard.
\newblock {Rowhammer.js}: A remote software-induced fault attack in
  {JavaScript}.
\newblock \emph{CoRR}, abs/1507.06955, 2015.
\newblock URL \url{http://arxiv.org/abs/1507.06955}.

\bibitem[Gueron(2016)]{gueron2016sgxmee}
Shay Gueron.
\newblock A memory encryption engine suitable for general purpose processors.
\newblock Cryptology ePrint Archive, Report 2016/204, 2016.

\bibitem[Hawkes(2012)]{hawkes2012microcode}
Ben Hawkes.
\newblock Security analysis of x86 processor microcode.
\newblock 2012.
\newblock [Online; accessed 7-January-2015].

\bibitem[Hennessy and Patterson(2012)]{hennessy2012architecture}
John~L. Hennessy and David~A. Patterson.
\newblock \emph{Computer Architecture - a Quantitative Approach (5 ed.)}.
\newblock Mogran Kaufmann, 2012.
\newblock ISBN 978-0-12-383872-8.

\bibitem[Herbst et~al.(2006)Herbst, Oswald, and Mangard]{herbst2006aes}
Christoph Herbst, Elisabeth Oswald, and Stefan Mangard.
\newblock An {AES} smart card implementation resistant to power analysis
  attacks.
\newblock In \emph{Applied cryptography and Network security}, pages 239--252.
  Springer, 2006.

\bibitem[Hildesheim et~al.(2014)Hildesheim, Anati, Shafi, Raikin, Gerzon,
  Savagaonkar, Rozas, McKeen, Goldsmith, and Prashant]{hildesheim2014ptm}
G.~Hildesheim, I.~Anati, H.~Shafi, S.~Raikin, G.~Gerzon, U.~R. Savagaonkar,
  C.~V. Rozas, F.~X. McKeen, M.~A. Goldsmith, and D.~Prashant.
\newblock Apparatus and method for page walk extension for enhanced security
  checks, 2014.
\newblock US Patent App. 13/730,563.

\bibitem[Hoekstra et~al.(2013)Hoekstra, Lal, Pappachan, Phegade, and
  Del~Cuvillo]{hoekstra2013sgx}
Matthew Hoekstra, Reshma Lal, Pradeep Pappachan, Vinay Phegade, and Juan
  Del~Cuvillo.
\newblock Using innovative instructions to create trustworthy software
  solutions.
\newblock In \emph{Proceedings of the 2nd International Workshop on Hardware
  and Architectural Support for Security and Privacy, HASP}, volume~13, 2013.

\bibitem[Hofemeier(2013)]{intel2013mefw}
Gael Hofemeier.
\newblock {Intel} manageability firmware recovery agent.
\newblock Mar 2013.
\newblock [Online; accessed 2-Dec-2015].

\bibitem[Hotz(2010)]{hotz2010ps3}
George Hotz.
\newblock {PS3} glitch hack.
\newblock 2010.
\newblock [Online; accessed 7-January-2015].

\bibitem[Huang(2003)]{huang2003xbox}
Andrew Huang.
\newblock \emph{Hacking the {Xbox}: an Introduction to Reverse Engineering}.
\newblock No Starch Press, 2003.

\bibitem[Hughes et~al.(2013)Hughes, Chen, Bomb, Brandt, Buxton, Charney,
  Chennupaty, Corbal, Dixon, Girkar, Hall, Ido, Lachner, Neiger, Newburn,
  Parthasarathy, Toll, Valentine, and Wiedemeier]{intel2013scattergather}
C.~J. Hughes, Y.~K. Chen, M.~Bomb, J.~W. Brandt, M.~J. Buxton, M.~J. Charney,
  S.~Chennupaty, J.~Corbal, M.~G. Dixon, M.~B. Girkar, Jonathan~C. Hall,
  Hideki~(Saito) Ido, Peter Lachner, Gilbert Neiger, Chris~J. Newburn,
  Rajesh~S. Parthasarathy, Bret~L. Toll, Robert Valentine, and Jeffrey~G.
  Wiedemeier.
\newblock Gathering and scattering multiple data elements, 2013.
\newblock US Patent 8,447,962.

\bibitem[IEE(2012)]{ieee8023ethernet}
\emph{IEEE Standard for Ethernet}.
\newblock IEEE Computer Society, Dec 2012.
\newblock IEEE Std. 802.3-2012.

\bibitem[Inci et~al.(2015)Inci, Gulmezoglu, Irazoqui, Eisenbarth, and
  Sunar]{inci2015rsachannel}
Mehmet~Sinan Inci, Berk Gulmezoglu, Gorka Irazoqui, Thomas Eisenbarth, and Berk
  Sunar.
\newblock Seriously, get off my cloud! cross-{VM} {RSA} key recovery in a
  public cloud.
\newblock Cryptology ePrint Archive, Report 2015/898, 2015.

\bibitem[Int(1999)]{intel1999psn}
\emph{{Intel}{\textregistered} Processor Serial Number}.
\newblock Intel Corporation, Mar 1999.
\newblock Order no. 245125-001.

\bibitem[Int(2010{\natexlab{a}})]{intel2009qpi}
\emph{An Introduction to the {Intel}{\textregistered} {QuickPath}
  Interconnect}.
\newblock Intel Corporation, Mar 2010{\natexlab{a}}.
\newblock Reference no. 323535-001.

\bibitem[Int(2010{\natexlab{b}})]{intel2010booting}
\emph{Minimal {Intel}{\textregistered} Architecture Boot Loader--Bare Bones
  Functionality Required for Booting an {Intel}{\textregistered} Architecture
  Platform}.
\newblock Intel Corporation, Jan 2010{\natexlab{b}}.
\newblock Reference no. 323246.

\bibitem[Int(2010{\natexlab{c}})]{intel2010errata}
\emph{Intel{\textregistered} {Core 2 Duo} and Intel{\textregistered} {Core 2
  Solo} Processor for {Intel}{\textregistered} {Centrino}{\textregistered}
  {Duo} Processor Technology {Intel}{\textregistered}
  {Celeron}{\textregistered} Processor 500 Series - Specification Update}.
\newblock Intel Corporation, Dec 2010{\natexlab{c}}.
\newblock Reference no. 314079-026.

\bibitem[Int(2010{\natexlab{d}})]{intel2010power}
\emph{{Intel}{\textregistered} architecture Platform Basics}.
\newblock Intel Corporation, Sep 2010{\natexlab{d}}.
\newblock Reference no. 324377.

\bibitem[Int(2010{\natexlab{e}})]{intel2010txtlab}
\emph{Intel{\textregistered} Trusted Execution Technology
  (Intel{\textregistered} {TXT}) {LAB} Handout}.
\newblock Intel Corporation, 2010{\natexlab{e}}.
\newblock [Online; accessed 2-July-2015].

\bibitem[Int(2010{\natexlab{f}})]{intel2010uncore}
\emph{{Intel}{\textregistered} {Xeon}{\textregistered} Processor 7500 Series
  Uncore Programming Guide}.
\newblock Intel Corporation, Mar 2010{\natexlab{f}}.
\newblock Reference no. 323535-001.

\bibitem[Int(2012{\natexlab{a}})]{intel2012mebringup}
\emph{{Intel}{\textregistered} 7 Series Family - {Intel}{\textregistered}
  Management Engine Firmware 8.1 - {1.5MB} Firmware Bring Up Guide}.
\newblock Intel Corporation, Jul 2012{\natexlab{a}}.
\newblock Revision 8.1.0.1248 - PV Release.

\bibitem[Int(2012{\natexlab{b}})]{intel2012uncore}
\emph{{Intel}{\textregistered} {Xeon}{\textregistered} Processor {E5-2600}
  Product Family Uncore Performance Monitoring Guide}.
\newblock Intel Corporation, Mar 2012{\natexlab{b}}.
\newblock Reference no. 327043-001.

\bibitem[Int(2013)]{intel2013sgxmanual}
\emph{Software Guard Extensions Programming Reference}.
\newblock Intel Corporation, 2013.
\newblock Reference no. 329298-001US.

\bibitem[Int(2014{\natexlab{a}})]{intel2010datasheet}
\emph{{Intel}{\textregistered} {Xeon}{\textregistered} Processor 7500 Series
  Datasheet - Volume Two}.
\newblock Intel Corporation, Mar 2014{\natexlab{a}}.
\newblock Reference no. 329595-002.

\bibitem[Int(2014{\natexlab{b}})]{intel2014datasheet}
\emph{{Intel}{\textregistered} {Xeon}{\textregistered} Processor {E7} v2
  2800/4800/8800 Product Family Datasheet - Volume Two}.
\newblock Intel Corporation, Mar 2014{\natexlab{b}}.
\newblock Reference no. 329595-002.

\bibitem[Int(2014{\natexlab{c}})]{intel2014optimization}
\emph{{Intel}{\textregistered} 64 and {IA-32} Architectures Optimization
  Reference Manual}.
\newblock Intel Corporation, Sep 2014{\natexlab{c}}.
\newblock Reference no. 248966-030.

\bibitem[Int(2014{\natexlab{d}})]{intel2014sgx2manual}
\emph{Software Guard Extensions Programming Reference}.
\newblock Intel Corporation, 2014{\natexlab{d}}.
\newblock Reference no. 329298-002US.

\bibitem[Int(2015{\natexlab{a}})]{intel2015chipset}
\emph{{Intel}{\textregistered} 100 Series Chipset Family Platform Controller
  Hub ({PCH}) Datasheet - Volume One}.
\newblock Intel Corporation, Aug 2015{\natexlab{a}}.
\newblock Reference no. 332690-001EN.

\bibitem[Int(2015{\natexlab{b}})]{intel2015cpuio}
\emph{Mobile 4th Generation {Intel}{\textregistered} Core{\textregistered}
  Processor Family {I/O} Datasheet}.
\newblock Intel Corporation, Feb 2015{\natexlab{b}}.
\newblock Reference no. 329003-003.

\bibitem[Int(2015{\natexlab{c}})]{intel2015datasheet}
\emph{{Intel}{\textregistered} {Xeon}{\textregistered} Processor {E5-1600},
  {E5-2400}, and {E5-2600} v3 Product Family Datasheet - Volume Two}.
\newblock Intel Corporation, Jan 2015{\natexlab{c}}.
\newblock Reference no. 330784-002.

\bibitem[Int(2015{\natexlab{d}})]{intel2015errata}
\emph{{Intel}{\textregistered} Xeon{\textregistered} Processor 5500 Series -
  Specification Update}.
\newblock Intel Corporation, 2 2015{\natexlab{d}}.
\newblock Reference no. 321324-018US.

\bibitem[Int(2015{\natexlab{e}})]{intel2015errata2}
\emph{Intel{\textregistered} Xeon{\textregistered} Processor {E5} Product
  Family - Specification Update}.
\newblock Intel Corporation, Jan 2015{\natexlab{e}}.
\newblock Reference no. 326150-018.

\bibitem[Int(2015{\natexlab{f}})]{intel2015iscasgx}
\emph{{Intel}{\textregistered} Software Guard Extensions
  ({Intel}{\textregistered} {SGX})}.
\newblock Intel Corporation, Jun 2015{\natexlab{f}}.
\newblock Reference no. 332680-002.

\bibitem[Int(2015{\natexlab{g}})]{intel2015sdm}
\emph{{Intel}{\textregistered} 64 and {IA-32} Architectures Software
  Developer's Manual}.
\newblock Intel Corporation, Sep 2015{\natexlab{g}}.
\newblock Reference no. 325462-056US.

\bibitem[Int(2015{\natexlab{h}})]{intel2015x99chipset}
\emph{{Intel}{\textregistered} {C610} Series Chipset and
  {Intel}{\textregistered} {X99} Chipset Platform Controller Hub ({PCH})
  Datasheet}.
\newblock Intel Corporation, Oct 2015{\natexlab{h}}.
\newblock Reference no. 330788-003.

\bibitem[Jacob and Mudge(1998)]{jacob1998virtual}
Bruce Jacob and Trevor Mudge.
\newblock Virtual memory: Issues of implementation.
\newblock \emph{Computer}, 31\penalty0 (6):\penalty0 33--43, 1998.

\bibitem[Johnson et~al.(2016)Johnson, Scarlata, Rozas, Brickell, and
  Mckeen]{johnson2016sgxprovisioning}
Simon Johnson, Vinnie Scarlata, Carlos Rozas, Ernie Brickell, and Frank Mckeen.
\newblock {Intel}{\textregistered} software guard extensions: {EPID}
  provisioning and attestation services.
\newblock
  \url{https://software.intel.com/en-us/blogs/2016/03/09/intel-sgx-epid-provisioning-and-attestation-services},
  Mar 2016.
\newblock [Online; accessed 21-Mar-2016].

\bibitem[Johnson et~al.(2010)Johnson, Savagaonkar, Scarlata, McKeen, and
  Rozas]{intel2013patent2}
Simon~P. Johnson, Uday~R. Savagaonkar, Vincent~R. Scarlata, Francis~X. McKeen,
  and Carlos~V. Rozas.
\newblock Technique for supporting multiple secure enclaves, Dec 2010.
\newblock US Patent 8,972,746.

\bibitem[Jonsson and Kaliski(2003)]{jonsson2003pkcsv21}
Jakob Jonsson and Burt Kaliski.
\newblock {{RFC 3447}: Public-Key Cryptography Standards ({PKCS}) \#1: {RSA}
  Cryptography Specifications Version 2.1}.
\newblock \emph{Internet RFCs}, Feb 2003.

\bibitem[Kaliski(1998)]{kaliski1998pkcs1v15}
Burt Kaliski.
\newblock {{RFC 2313}: {PKCS} \#1: {RSA} Encryption Version 1.5}.
\newblock \emph{Internet RFCs}, Mar 1998.

\bibitem[Kaliski and Staddon(1998)]{kaliski1998pkcs1v2}
Burt Kaliski and Jessica Staddon.
\newblock {{RFC 2437}: {PKCS} \#1: {RSA} Encryption Version 2.0}.
\newblock \emph{Internet RFCs}, Oct 1998.

\bibitem[Kallenberg et~al.(2014)Kallenberg, Kovah, Butterworth, and
  Cornwell]{kallenberg2014smm}
Corey Kallenberg, Xeno Kovah, John Butterworth, and Sam Cornwell.
\newblock Extreme privilege escalation on windows 8/{UEFI} systems, 2014.

\bibitem[K{\"a}sper and Schwabe(2009)]{kasper2009aes}
Emilia K{\"a}sper and Peter Schwabe.
\newblock Faster and timing-attack resistant {AES-GCM}.
\newblock In \emph{Cryptographic Hardware and Embedded Systems-CHES 2009},
  pages 1--17. Springer, 2009.

\bibitem[Katz and Lindell(2014)]{katz2014crypto}
Jonathan Katz and Yehuda Lindell.
\newblock \emph{Introduction to modern cryptography}.
\newblock CRC Press, 2014.

\bibitem[Kessler and Hill(1992)]{kessler1992coloring}
Richard~E. Kessler and Mark~D. Hill.
\newblock Page placement algorithms for large real-indexed caches.
\newblock \emph{ACM Transactions on Computer Systems (TOCS)}, 10\penalty0
  (4):\penalty0 338--359, 1992.

\bibitem[Kim and Zeldovich(2013)]{kim2013seccompbpf}
Taesoo Kim and Nickolai Zeldovich.
\newblock Practical and effective sandboxing for non-root users.
\newblock In \emph{USENIX Annual Technical Conference}, pages 139--144, 2013.

\bibitem[Kim et~al.(2014)Kim, Daly, Kim, Fallin, Lee, Lee, Wilkerson, Lai, and
  Mutlu]{kim2014rowhammer}
Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji~Hye Lee, Donghyuk Lee,
  Chris Wilkerson, Konrad Lai, and Onur Mutlu.
\newblock Flipping bits in memory without accessing them: An experimental study
  of {DRAM} disturbance errors.
\newblock In \emph{Proceeding of the 41st annual International Symposium on
  Computer Architecuture}, pages 361--372. IEEE Press, 2014.

\bibitem[Knauth and Irelan(2014)]{intel2014pebs}
L.~A. Knauth and P.~J. Irelan.
\newblock Apparatus and method for providing eventing ip and source data
  address in a statistical sampling infrastructure, 2014.
\newblock US Patent App. 13/976,613.

\bibitem[Koblitz(1987)]{koblitz1987ecc}
N.~Koblitz.
\newblock Elliptic curve cryptosystems.
\newblock \emph{Mathematics of Computation}, 48\penalty0 (177):\penalty0
  203--209, 1987.

\bibitem[Kocher et~al.(1999)Kocher, Jaffe, and Jun]{kocher1999dpa}
Paul Kocher, Joshua Jaffe, and Benjamin Jun.
\newblock Differential power analysis.
\newblock In \emph{Advances in Cryptology (CRYPTO)}, pages 388--397. Springer,
  1999.

\bibitem[Kocher(1996)]{kocher1996timing}
Paul~C. Kocher.
\newblock Timing attacks on implementations of {Diffie-Hellman}, {RSA}, {DSS},
  and other systems.
\newblock In \emph{Advances in Cryptology -- CRYPTO’96}, pages 104--113.
  Springer, 1996.

\bibitem[Krawczyk et~al.(1997)Krawczyk, Canetti, and Bellare]{krawczyk1997hmac}
Hugo Krawczyk, Ran Canetti, and Mihir Bellare.
\newblock {HMAC}: Keyed-hashing for message authentication.
\newblock 1997.

\bibitem[Kuhn(2005)]{kuhn2005lcdpa}
Markus~G. Kuhn.
\newblock Electromagnetic eavesdropping risks of flat-panel displays.
\newblock In \emph{Privacy Enhancing Technologies}, pages 88--107. Springer,
  2005.

\bibitem[Kurts et~al.(2011)Kurts, Savransky, Ratner, Hazan, Skaba, Elmosnino,
  and Santhanakrishnan]{intel2011gdxc}
Tsvika Kurts, Guillermo Savransky, Jason Ratner, Eilon Hazan, Daniel Skaba,
  Sharon Elmosnino, and Geeyarpuram~N. Santhanakrishnan.
\newblock Generic debug {eXternal} connection (gdxc) for high integration
  integrated circuits, 2011.
\newblock US Patent 8,074,131.

\bibitem[Levinthal(2010)]{intel2010perfanalysis}
David Levinthal.
\newblock Performance analysis guide for {Intel}{\textregistered} {Core} i7
  processor and {Intel}{\textregistered} {Xeon} 5500 processors.
\newblock
  \url{https://software.intel.com/sites/products/collateral/hpc/vtune/performance_analysis_guide.pdf},
  2010.
\newblock [Online; accessed 26-January-2015].

\bibitem[Lie et~al.(2000)Lie, Thekkath, Mitchell, Lincoln, Boneh, Mitchell, and
  Horowitz]{lie2000xom}
David Lie, Chandramohan Thekkath, Mark Mitchell, Patrick Lincoln, Dan Boneh,
  John Mitchell, and Mark Horowitz.
\newblock Architectural support for copy and tamper resistant software.
\newblock \emph{ACM SIGPLAN Notices}, 35\penalty0 (11):\penalty0 168--177,
  2000.

\bibitem[Lin et~al.(2008)Lin, Lu, Ding, Zhang, Zhang, and
  Sadayappan]{lin2008coloring}
Jiang Lin, Qingda Lu, Xiaoning Ding, Zhao Zhang, Xiaodong Zhang, and
  P.~Sadayappan.
\newblock Gaining insights into multicore cache partitioning: Bridging the gap
  between simulation and real systems.
\newblock In \emph{14th International IEEE Symposium on High Performance
  Computer Architecture (HPCA)}, pages 367--378. IEEE, 2008.

\bibitem[Liskov and Zilles(1974)]{liskov1974adt}
Barbara Liskov and Stephen Zilles.
\newblock Programming with abstract data types.
\newblock In \emph{ACM Sigplan Notices}, volume~9, pages 50--59. ACM, 1974.

\bibitem[Liu et~al.(2015)Liu, Yarom, Ge, Heiser, and Lee]{liu2015llctiming}
Fangfei Liu, Yuval Yarom, Qian Ge, Gernot Heiser, and Ruby~B. Lee.
\newblock Last-level cache side-channel attacks are practical.
\newblock In \emph{Security and Privacy (SP), 2015 IEEE Symposium on}, pages
  143--158. IEEE, 2015.

\bibitem[Maas et~al.(2013)Maas, Love, Stefanov, Tiwari, Shi, Asanovic,
  Kubiatowicz, and Song]{maas2013phantom}
Martin Maas, Eric Love, Emil Stefanov, Mohit Tiwari, Elaine Shi, Krste
  Asanovic, John Kubiatowicz, and Dawn Song.
\newblock Phantom: Practical oblivious computation in a secure processor.
\newblock In \emph{Proceedings of the 2013 ACM SIGSAC conference on Computer \&
  communications security}, pages 311--324. ACM, 2013.

\bibitem[Manger(2001)]{manger2001pkcs1v20attack}
James Manger.
\newblock A chosen ciphertext attack on {RSA} optimal asymmetric encryption
  padding ({OAEP}) as standardized in {PKCS}\# 1 v2.0.
\newblock In \emph{Advances in Cryptology -- CRYPTO 2001}, pages 230--238.
  Springer, 2001.

\bibitem[Maurice et~al.(2015)Maurice, Le~Scouarnec, Neumann, Heen, and
  Francillon]{maurice2015intelhash}
Cl{\'e}mentine Maurice, Nicolas Le~Scouarnec, Christoph Neumann, Olivier Heen,
  and Aur{\'e}lien Francillon.
\newblock Reverse engineering {Intel} last-level cache complex addressing using
  performance counters.
\newblock In \emph{Proceedings of the 18th International Symposium on Research
  in Attacks, Intrusions and Defenses (RAID)}, 2015.

\bibitem[McCune et~al.(2010)McCune, Li, Qu, Zhou, Datta, Gligor, and
  Perrig]{mccune2010trustvisor}
Jonathan~M. McCune, Yanlin Li, Ning Qu, Zongwei Zhou, Anupam Datta, Virgil
  Gligor, and Adrian Perrig.
\newblock {TrustVisor}: Efficient {TCB} reduction and attestation.
\newblock In \emph{Security and Privacy (SP), 2010 IEEE Symposium on}, pages
  143--158. IEEE, 2010.

\bibitem[McGrew and Viega(2004)]{mcgrew2004gcm}
David McGrew and John Viega.
\newblock The galois/counter mode of operation ({GCM}).
\newblock 2004.
\newblock [Online; accessed 28-December-2015].

\bibitem[McKeen et~al.(2009)McKeen, Rozas, Savagaonkar, Johnson, Scarlata,
  Goldsmith, Brickell, Li, Herbert, Dewan, Tolopka, Neiger, Durham, Graunke,
  Lint, Van~Dyke, Cihula, Jeyasingh, Van~Doren, Rodgers, Garney, and
  Altman]{intel2013patent1}
Francis~X. McKeen, Carlos~V. Rozas, Uday~R. Savagaonkar, Simon~P. Johnson,
  Vincent Scarlata, Michael~A. Goldsmith, Ernie Brickell, Jiang~Tao Li,
  Howard~C. Herbert, Prashant Dewan, Stephen~J. Tolopka, Gilbert Neiger, David
  Durham, Gary Graunke, Bernard Lint, Don~A. Van~Dyke, Joseph Cihula,
  Stalinselvaraj Jeyasingh, Stephen~R. Van~Doren, Dion Rodgers, John Garney,
  and Asher Altman.
\newblock Method and apparatus to provide secure application execution, Dec
  2009.
\newblock US Patent 9,087,200.

\bibitem[McKeen et~al.(2013)McKeen, Alexandrovich, Berenzon, Rozas, Shafi,
  Shanbhogue, and Savagaonkar]{mckeen2013sgx}
Frank McKeen, Ilya Alexandrovich, Alex Berenzon, Carlos~V. Rozas, Hisham Shafi,
  Vedvyas Shanbhogue, and Uday~R. Savagaonkar.
\newblock Innovative instructions and software model for isolated execution.
\newblock \emph{HASP}, 13:\penalty0 10, 2013.

\bibitem[Naehrig et~al.(2011)Naehrig, Lauter, and
  Vaikuntanathan]{naehrig2011can}
Michael Naehrig, Kristin Lauter, and Vinod Vaikuntanathan.
\newblock Can homomorphic encryption be practical?
\newblock In \emph{Proceedings of the 3rd ACM workshop on Cloud computing
  security workshop}, pages 113--124. ACM, 2011.

\bibitem[{National Institute of Standards and Technology
  (NIST)}(2001)]{fips2001aes}
{National Institute of Standards and Technology (NIST)}.
\newblock The advanced encryption standard ({AES}).
\newblock \emph{Federal Information Processing Standards (FIPS) Publications
  (PUBS)}, 197, Nov 2001.

\bibitem[{National Institute of Standards and Technology
  (NIST)}(2013)]{fips2013dss}
{National Institute of Standards and Technology (NIST)}.
\newblock The digital signature standard ({DSS}).
\newblock \emph{Federal Information Processing Standards (FIPS) Processing
  Standards Publications (PUBS)}, 186-4, Jul 2013.

\bibitem[{National Security Agency (NSA) Central Security Service
  (CSS)}(2015)]{nsa2015suiteb}
{National Security Agency (NSA) Central Security Service (CSS)}.
\newblock Cryptography today on suite {B} phase-out.
\newblock \url{https://www.nsa.gov/ia/programs/suiteb_cryptography/}, Aug 2015.
\newblock [Online; accessed 28-December-2015].

\bibitem[Natu et~al.(2012)Natu, Datta, Wiedemeier, Vash, Kottapalli, Bobholz,
  and Baum]{intel2012ltsx}
M.~S. Natu, S.~Datta, J.~Wiedemeier, J.~R. Vash, S.~Kottapalli, S.~P. Bobholz,
  and A.~Baum.
\newblock Supporting advanced {RAS} features in a secured computing system,
  2012.
\newblock US Patent 8,301,907.

\bibitem[Oren et~al.(2015)Oren, Kemerlis, Sethumadhavan, and
  Keromytis]{oren2015jstiming}
Yossef Oren, Vasileios~P. Kemerlis, Simha Sethumadhavan, and Angelos~D.
  Keromytis.
\newblock The spy in the sandbox -- practical cache attacks in {JavaScript}.
\newblock \emph{arXiv preprint arXiv:1502.07373}, 2015.

\bibitem[Osvik et~al.(2006)Osvik, Shamir, and Tromer]{osvik2006aes}
Dag~Arne Osvik, Adi Shamir, and Eran Tromer.
\newblock Cache attacks and countermeasures: the case of {AES}.
\newblock In \emph{Topics in Cryptology--CT-RSA 2006}, pages 1--20. Springer,
  2006.

\bibitem[Owens et~al.(2009)Owens, Sarkar, and Sewell]{owens2009tso}
Scott Owens, Susmit Sarkar, and Peter Sewell.
\newblock A better x86 memory model: {x86-TSO} (extended version).
\newblock \emph{University of Cambridge, Computer Laboratory, Technical
  Report}, \penalty0 (UCAM-CL-TR-745), 2009.

\bibitem[Owusu et~al.(2012)Owusu, Han, Das, Perrig, and
  Zhang]{owusu2012accessory}
Emmanuel Owusu, Jun Han, Sauvik Das, Adrian Perrig, and Joy Zhang.
\newblock {ACCessory}: password inference using accelerometers on smartphones.
\newblock In \emph{Proceedings of the Twelfth Workshop on Mobile Computing
  Systems \& Applications}, page~9. ACM, 2012.

\bibitem[Papworth et~al.(1999)Papworth, Hinton, Fetterman, Colwell, and
  Glew]{intel1999exceptions}
D.~B. Papworth, G.~J. Hinton, M.~A. Fetterman, R.~P. Colwell, and A.~F. Glew.
\newblock Exception handling in a processor that performs speculative
  out-of-order instruction execution, 1999.
\newblock US Patent 5,987,600.

\bibitem[Patterson and Hennessy(2013)]{patterson2013architecture}
David~A. Patterson and John~L. Hennessy.
\newblock \emph{Computer Organization and Design: the hardware/software
  interface}.
\newblock Morgan Kaufmann, 2013.
\newblock ISBN 978-0-12-374750-1.

\bibitem[{Pessl} et~al.(2015){Pessl}, {Gruss}, {Maurice}, {Schwarz}, and
  {Mangard}]{pessil2015dramaddressing}
P.~{Pessl}, D.~{Gruss}, C.~{Maurice}, M.~{Schwarz}, and S.~{Mangard}.
\newblock Reverse engineering {Intel} {DRAM} addressing and exploitation.
\newblock \emph{ArXiv e-prints}, Nov 2015.

\bibitem[Petters and Farber(1999)]{petters1999making}
Stefan~M. Petters and Georg Farber.
\newblock Making worst case execution time analysis for hard real-time tasks on
  state of the art processors feasible.
\newblock In \emph{Sixth International Conference on Real-Time Computing
  Systems and Applications}, pages 442--449. IEEE, 1999.

\bibitem[Qureshi and Nicholes(2006)]{qureshi2006fit}
S.~A. Qureshi and M.~O. Nicholes.
\newblock System and method for using a firmware interface table to dynamically
  load an {ACPI} {SSDT}, 2006.
\newblock US Patent 6,990,576.

\bibitem[Raikin and Valentine(2014)]{intel2014gather}
S.~Raikin and R.~Valentine.
\newblock Gather cache architecture, 2014.
\newblock US Patent 8,688,962.

\bibitem[Raikin et~al.(2014)Raikin, Hamama, Chappell, Rust, Luu, Ong, and
  Hildesheim]{raikin2014tlb}
S.~Raikin, O.~Hamama, R.~S. Chappell, C.~B. Rust, H.~S. Luu, L.~A. Ong, and
  G.~Hildesheim.
\newblock Apparatus and method for a multiple page size translation lookaside
  buffer ({TLB}), 2014.
\newblock US Patent App. 13/730,411.

\bibitem[Reinauer(2013)]{reinauer2013fitpatch}
Stefan Reinauer.
\newblock x86 {Intel}: Add firmware interface table support.
\newblock \url{http://review.coreboot.org/#/c/2642/}, 2013.
\newblock [Online; accessed 2-July-2015].

\bibitem[Ristenpart et~al.(2009)Ristenpart, Tromer, Shacham, and
  Savage]{ristenpart2009colocation}
Thomas Ristenpart, Eran Tromer, Hovav Shacham, and Stefan Savage.
\newblock Hey, you, get off of my cloud: Exploring information leakage in
  third-party compute clouds.
\newblock In \emph{Proceedings of the 16th ACM Conference on Computer and
  Communications Security}, pages 199--212. ACM, 2009.

\bibitem[Rivest et~al.(1978)Rivest, Shamir, and Adleman]{rivest1978rsa}
R.~L. Rivest, A.~Shamir, and L.~Adleman.
\newblock A method for obtaining digital signatures and public-key
  cryptosystems.
\newblock \emph{Communications of the ACM}, 21\penalty0 (2):\penalty0 120--126,
  1978.

\bibitem[Rodgers et~al.(1997)Rodgers, Tiruvallur, Rhodehamel, Konigsfeld, Glew,
  Akkary, Karnik, and Brayton]{intel1997microspace}
S.~D. Rodgers, K.~K. Tiruvallur, M.~W. Rhodehamel, K.~G. Konigsfeld, A.~F.
  Glew, H.~Akkary, M.~A. Karnik, and J.~A. Brayton.
\newblock Method and apparatus for performing operations based upon the
  addresses of microinstructions, 1997.
\newblock US Patent 5,636,374.

\bibitem[Rodgers et~al.(1999)Rodgers, Vidwans, Huang, Fetterman, and
  Huck]{intel1999events}
S.~D. Rodgers, R.~Vidwans, J.~Huang, M.~A. Fetterman, and K.~Huck.
\newblock Method and apparatus for generating event handler vectors based on
  both operating mode and event type, 1999.
\newblock US Patent 5,889,982.

\bibitem[Rosenblum and Garfinkel(2005)]{rosenblum2005virtualization}
M.~Rosenblum and T.~Garfinkel.
\newblock Virtual machine monitors: current technology and future trends.
\newblock \emph{Computer}, 38\penalty0 (5):\penalty0 39--47, May 2005.

\bibitem[Ruan(2014)]{ruan2014intelme}
Xiaoyu Ruan.
\newblock \emph{Platform Embedded Security Technology Revealed}.
\newblock Apress, 2014.
\newblock ISBN 978-1-4302-6571-9.

\bibitem[Rutkowska(2015)]{rutkowska2015intelsux}
Joanna Rutkowska.
\newblock {Intel} x86 considered harmful.
\newblock \url{https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf},
  Oct 2015.
\newblock [Online; accessed 2-Nov-2015].

\bibitem[Rutkowska and Wojtczuk(2008)]{rutkowska2008remap}
Joanna Rutkowska and Rafa{\l} Wojtczuk.
\newblock Preventing and detecting {Xen} hypervisor subversions.
\newblock \emph{Blackhat Briefings USA}, 2008.

\bibitem[Saltzer and Kaashoek(2009)]{saltzer2009systemdesign}
Jerome~H. Saltzer and M.~Frans Kaashoek.
\newblock \emph{Principles of Computer System Design: An Introduction}.
\newblock Morgan Kaufmann, 2009.

\bibitem[Seaborn and Dullien(2015)]{google2015rowhammer}
Mark Seaborn and Thomas Dullien.
\newblock Exploiting the {DRAM} rowhammer bug to gain kernel privileges.
\newblock
  \url{http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html},
  Mar 2015.
\newblock [Online; accessed 9-March-2015].

\bibitem[Shanbhogue and Robinson(2014)]{intel2014vapic}
V.~Shanbhogue and S.~J. Robinson.
\newblock Enabling virtualization of a processor resource, 2014.
\newblock US Patent 8,806,104.

\bibitem[Shankland(2005)]{cnet2005itanium}
Stephen Shankland.
\newblock Itanium: A cautionary tale.
\newblock Dec 2005.
\newblock [Online; accessed 11-February-2015].

\bibitem[Smith(1982)]{smith1982cache}
Alan~Jay Smith.
\newblock Cache memories.
\newblock \emph{ACM Computing Surveys (CSUR)}, 14\penalty0 (3):\penalty0
  473--530, 1982.

\bibitem[Smith and Weingart(1999)]{smith1999ibm4758}
Sean~W. Smith and Steve Weingart.
\newblock Building a high-performance, programmable secure coprocessor.
\newblock \emph{Computer Networks}, 31\penalty0 (8):\penalty0 831--860, 1999.

\bibitem[Smith et~al.(1999)Smith, Perez, Weingart, and
  Austel]{smith1999validating}
Sean~W. Smith, Ron Perez, Steve Weingart, and Vernon Austel.
\newblock Validating a high-performance, programmable secure coprocessor.
\newblock In \emph{22nd National Information Systems Security Conference}. IBM
  Thomas J. Watson Research Division, 1999.

\bibitem[Stevens et~al.(2015)Stevens, Karpman, and
  Peyrin]{stevens2015sha1attack}
Marc Stevens, Pierre Karpman, and Thomas Peyrin.
\newblock Free-start collision on full {SHA-1}.
\newblock Cryptology ePrint Archive, Report 2015/967, 2015.

\bibitem[Suh et~al.(2003)Suh, Clarke, Gassend, Van~Dijk, and
  Devadas]{suh2003aegis}
G.~Edward Suh, Dwaine Clarke, Blaise Gassend, Marten Van~Dijk, and Srinivas
  Devadas.
\newblock {AEGIS}: architecture for tamper-evident and tamper-resistant
  processing.
\newblock In \emph{Proceedings of the 17th annual international conference on
  Supercomputing}, pages 160--171. ACM, 2003.

\bibitem[Suh et~al.(2005)Suh, O'Donnell, Sachdev, and Devadas]{aegis_impl}
G.~Edward Suh, Charles~W. O'Donnell, Ishan Sachdev, and Srinivas Devadas.
\newblock {Design and Implementation of the {\sc AEGIS} Single-Chip Secure
  Processor Using Physical Random Functions}.
\newblock In \emph{Proceedings of the $32^{nd}$ ISCA'05}. ACM, June 2005.

\bibitem[Taylor et~al.(1990)Taylor, Davies, and Farmwald]{taylor1990coloring}
George Taylor, Peter Davies, and Michael Farmwald.
\newblock The {TLB} slice - a low-cost high-speed address translation
  mechanism.
\newblock \emph{SIGARCH Computer Architecture News}, 18\penalty0
  (2SI):\penalty0 355--363, 1990.

\bibitem[{TCG}(2003)]{grawrock2003tpm}
Trusted Computing~Group {TCG}.
\newblock Tpm main specification.
\newblock
  \url{http://www.trustedcomputinggroup.org/resources/tpm\_main\_specification},
  2003.

\bibitem[Tereshkin and Wojtczuk(2009)]{tereshkin2009amt}
Alexander Tereshkin and Rafal Wojtczuk.
\newblock Introducing ring-3 rootkits.
\newblock Master's thesis, 2009.

\bibitem[Tiri et~al.(2002)Tiri, Akmal, and Verbauwhede]{tiri2002dcmos}
Kris Tiri, Moonmoon Akmal, and Ingrid Verbauwhede.
\newblock A dynamic and differential {CMOS} logic with signal independent power
  consumption to withstand differential power analysis on smart cards.
\newblock In \emph{Proceedings of the 28th European Solid-State Circuits
  Conference (ESSCIRC)}, pages 403--406. IEEE, 2002.

\bibitem[UEF(2015)]{forum2015uefi}
\emph{Unified Extensible Firmware Interface Specification, Version 2.5}.
\newblock UEFI Forum, 2015.
\newblock [Online; accessed 1-Jul-2015].

\bibitem[Uhlig et~al.(2005)Uhlig, Neiger, Rodgers, Santoni, Martins, Anderson,
  Bennett, Kagi, Leung, and Smith]{uhlig2005vmx}
Rich Uhlig, Gil Neiger, Dion Rodgers, Amy~L. Santoni, Fernando C.~M. Martins,
  Andrew~V. Anderson, Steven~M. Bennett, Alain Kagi, Felix~H. Leung, and Larry
  Smith.
\newblock {Intel} virtualization technology.
\newblock \emph{Computer}, 38\penalty0 (5):\penalty0 48--56, 2005.

\bibitem[Van~Eck(1985)]{van1985monitorpa}
Wim Van~Eck.
\newblock Electromagnetic radiation from video display units: an eavesdropping
  risk?
\newblock \emph{Computers \& Security}, 4\penalty0 (4):\penalty0 269--286,
  1985.

\bibitem[Vasudevan et~al.(2010)Vasudevan, McCune, Qu, Van~Doorn, and
  Perrig]{vasudevan2010requirements}
Amit Vasudevan, Jonathan~M. McCune, Ning Qu, Leendert Van~Doorn, and Adrian
  Perrig.
\newblock Requirements for an integrity-protected hypervisor on the x86
  hardware virtualized architecture.
\newblock In \emph{Trust and Trustworthy Computing}, pages 141--165. Springer,
  2010.

\bibitem[Venkataramani(2011)]{intel2010bringup}
Sathish Venkataramani.
\newblock \emph{Advanced Board Bring Up - Power Sequencing Guide for Embedded
  {Intel} Architecture}.
\newblock Intel Corporation, Apr 2011.
\newblock Reference no. 325268.

\bibitem[Ververis(2010)]{ververis2010security}
Vassilios Ververis.
\newblock Security evaluation of {Intel}'s active management technology.
\newblock 2010.

\bibitem[Wecherowski(2009)]{wecherowski2009smm}
Filip Wecherowski.
\newblock A real {SMM} rootkit: Reversing and hooking {BIOS} {SMI} handlers.
\newblock \emph{Phrack Magazine}, 13\penalty0 (66), 2009.

\bibitem[Wojtczuk and Rutkowska(2009{\natexlab{a}})]{wojtczuk2009smm}
Rafal Wojtczuk and Joanna Rutkowska.
\newblock Attacking {SMM} memory via {Intel} {CPU} cache poisoning.
\newblock \emph{Invisible Things Lab}, 2009{\natexlab{a}}.

\bibitem[Wojtczuk and Rutkowska(2009{\natexlab{b}})]{wojtczuk2009txt}
Rafal Wojtczuk and Joanna Rutkowska.
\newblock Attacking {Intel} trusted execution technology.
\newblock \emph{Black Hat DC}, 2009{\natexlab{b}}.

\bibitem[Wojtczuk and Rutkowska(2011)]{wojtczuk2011txt}
Rafal Wojtczuk and Joanna Rutkowska.
\newblock Attacking intel {TXT} via {SINIT} code execution hijacking, 2011.

\bibitem[Wojtczuk and Tereshkin(2010)]{wojtczuk2010bios}
Rafal Wojtczuk and Alexander Tereshkin.
\newblock Attacking {Intel}{\textregistered} {BIOS}.
\newblock \emph{Invisible Things Lab}, 2010.

\bibitem[Wojtczuk et~al.(2009)Wojtczuk, Rutkowska, and
  Tereshkin]{wojtczuk2009txt2}
Rafal Wojtczuk, Joanna Rutkowska, and Alexander Tereshkin.
\newblock Another way to circumvent {Intel}{\textregistered} trusted execution
  technology.
\newblock \emph{Invisible Things Lab}, 2009.

\bibitem[Wu and Breternitz(2008)]{intel2008genetic}
Y.~Wu and M.~Breternitz.
\newblock Genetic algorithm for microcode compression, 2008.
\newblock US Patent 7,451,121.

\bibitem[Wu et~al.(2012)Wu, Kim, Breternitz, and Hum]{intel2012clusters}
Y.~Wu, S.~Kim, M.~Breternitz, and H.~Hum.
\newblock Compressing and accessing a microcode {ROM}, 2012.
\newblock US Patent 8,099,587.

\bibitem[Xu et~al.(2015)Xu, Cui, and Peinado]{xu2015pagefaults}
Yuanzhong Xu, Weidong Cui, and Marcus Peinado.
\newblock Controlled-channel attacks: Deterministic side channels for untrusted
  operating systems.
\newblock In \emph{Proceedings of the 36th IEEE Symposium on Security and
  Privacy (Oakland)}. IEEE -- Institute of Electrical and Electronics
  Engineers, May 2015.

\bibitem[Yao(1986)]{Yao1986}
A.~C. Yao.
\newblock How to generate and exchange secrets.
\newblock In \emph{Proceedings of the 27th Annual Symposium on Foundations of
  Computer Science}, pages 162--167, 1986.

\bibitem[Yarom and Falkner(2013)]{yarom2013llctiming}
Yuval Yarom and Katrina~E. Falkner.
\newblock {Flush+Reload}: a high resolution, low noise, {L3} cache side-channel
  attack.
\newblock \emph{IACR Cryptology ePrint Archive}, 2013:\penalty0 448, 2013.

\bibitem[Yarom et~al.(2015)Yarom, Ge, Liu, Lee, and Heiser]{yarom2015intelhash}
Yuval Yarom, Qian Ge, Fangfei Liu, Ruby~B. Lee, and Gernot Heiser.
\newblock Mapping the {Intel} last-level cache.
\newblock Cryptology ePrint Archive, Report 2015/905, 2015.

\bibitem[Yee(1994)]{yee1994coprocessors}
Bennet Yee.
\newblock \emph{Using secure coprocessors}.
\newblock PhD thesis, Carnegie Mellon University, 1994.

\bibitem[Yuffe et~al.(2011)Yuffe, Knoll, Mehalel, Shor, and
  Kurts]{yuffe2011sandybridge}
Marcelo Yuffe, Ernest Knoll, Moty Mehalel, Joseph Shor, and Tsvika Kurts.
\newblock A fully integrated multi-{CPU}, {GPU} and memory controller 32nm
  processor.
\newblock In \emph{Solid-State Circuits Conference Digest of Technical Papers
  (ISSCC), 2011 IEEE International}, pages 264--266. IEEE, 2011.

\bibitem[Zhang and Dong(2008)]{zhang2008xen}
Xiantao Zhang and Yaozu Dong.
\newblock Optimizing {Xen} {VMM} based on {Intel}{\textregistered}
  virtualization technology.
\newblock In \emph{Internet Computing in Science and Engineering, 2008.
  ICICSE'08. International Conference on}, pages 367--374. IEEE, 2008.

\bibitem[Zhuang et~al.(2009)Zhuang, Zhou, and Tygar]{zhuang2009keyboard}
Li~Zhuang, Feng Zhou, and J.~Doug Tygar.
\newblock Keyboard acoustic emanations revisited.
\newblock \emph{ACM Transactions on Information and System Security (TISSEC)},
  13\penalty0 (1):\penalty0 3, 2009.

\bibitem[Zimmer and Robinson(2012)]{intel2012patching}
V.~J. Zimmer and S.~H. Robinson.
\newblock Methods and systems for microcode patching, 2012.
\newblock US Patent 8,296,528.

\bibitem[Zimmer and Yao(2012)]{intel2012uefihypervisor}
V.~J. Zimmer and J.~Yao.
\newblock Method and apparatus for sequential hypervisor invocation, 2012.
\newblock US Patent 8,321,931.

\end{thebibliography}
