I am having trouble to completely understand the Prime & Probe attack: My current understanding is this:
Priming phase: The attacker occupies all cache sets with attacker data.
Probe phase: The attacker measures access time to figure out which set of data was accessed by the victim.
But the set is only part of the address. How can an attacker still deduce which address exactly was accessed? I know that this something to do with spatial/temporal locality, but I am struggling to understand how exactly an attacker could abuse this to obtain the full address a victim accessed?
Edit: To add some more context: I am studying for an exam at the moment and after a general explanation of the
prime & probe attack, the slide mentions the following:
Question: The set is only a part of the address, why does it still give away important information to the attacker?
A: Because the cache makes use of the temporal & spatial locality properties of computer programs
Where spatial and temporal locality refer to the assumption that in programs, when an address is accessed it is likely to be accessed again in the near future (temporal locality) or an address near to it is likely to be accessed again in the near feature (spatial locality). The slides then conclude that because of temporal & spatial locality:
Data objects with ”close” proximity, i.e. entries of a table, are stored in different sets
(For example, for a two-dimensional table, each table line would be stored in a different set). This is to prevent that those object compete for the cache.
But I still do not understand how this could help us for side-channel attacks?