3 ms·

[related] Has anyone considered the possibility of a Spectre-style attack in Ethereum's Turing-complete EVM? Not that the state would be unique for all contract

[related] Has anyone considered the possibility of a Spectre-style attack in Ethereum's Turing-complete EVM? Not that the state would be unique for all contracts, but there's a possibility of communicating to an external contract with the output.

lkjkjhkjhjkh 9y ago
GPU's don't have branch prediction, so that's nice.
moyix 9y ago
There's a twitter thread where some cryptographers speculate on the possibility. The upshot is that it doesn't seem like it will be possible: https://twitter.com/bascule/status/948725249842937857 https://twitter.com/bascule/status/948725249842937857
gibybo 9y ago
From my understanding there are a couple things that probably make this a non-issue: 1) Worst case scenario, it only allow you to read the memory of systems running validator nodes. There aren't very many of these (tens of thousands perhaps) and they generally don't store particularly valuable secrets. A small number of them may store private keys to Eth accounts with a small amount of Eth, but that's not typical operating procedure. 2) The EVM doesn't have any internal mechanism for measuring time (beyond existing blocks), so any timing attack within the EVM would require some very clever way of measuring time.
_callcc 9y ago
In the Spectre paper they note that while Chrome degrades the resolution of `performance.now()`, they were able to get a timer with sufficient resolution by using a Web Worker (thread) which repeatedly decrements a value in shared memory. As far as I know the EVM intentionally doesn't provide any concurrency because execution must be deterministic, and it seems doubtful that any kind of message-passing from outside the contract would be fast enough to provide the resolution needed. However, the block-lattice cryptos like RaiBlocks that find a way to build in concurrency and shared memory might be different.
techman9 9y ago
Does the Ethereum VM have branch prediction or speculative execution. I'm not sure how you'd construct a side channel of this nature against it if it doesn't.
- TazeTSchnitzel 9y ago
  The VM just needs branches, it's the host CPU's prediction you're messing with.

lkjkjhkjhjkh 9y ago

GPU's don't have branch prediction, so that's nice.

moyix 9y ago

There's a twitter thread where some cryptographers speculate on the possibility. The upshot is that it doesn't seem like it will be possible: https://twitter.com/bascule/status/948725249842937857 https://twitter.com/bascule/status/948725249842937857

gibybo 9y ago

From my understanding there are a couple things that probably make this a non-issue: 1) Worst case scenario, it only allow you to read the memory of systems running validator nodes. There aren't very many of these (tens of thousands perhaps) and they generally don't store particularly valuable secrets. A small number of them may store private keys to Eth accounts with a small amount of Eth, but that's not typical operating procedure. 2) The EVM doesn't have any internal mechanism for measuring time (beyond existing blocks), so any timing attack within the EVM would require some very clever way of measuring time.

_callcc 9y ago

In the Spectre paper they note that while Chrome degrades the resolution of `performance.now()`, they were able to get a timer with sufficient resolution by using a Web Worker (thread) which repeatedly decrements a value in shared memory. As far as I know the EVM intentionally doesn't provide any concurrency because execution must be deterministic, and it seems doubtful that any kind of message-passing from outside the contract would be fast enough to provide the resolution needed. However, the block-lattice cryptos like RaiBlocks that find a way to build in concurrency and shared memory might be different.

techman9 9y ago

Does the Ethereum VM have branch prediction or speculative execution. I'm not sure how you'd construct a side channel of this nature against it if it doesn't.

TazeTSchnitzel 9y ago
The VM just needs branches, it's the host CPU's prediction you're messing with.