4 ms·

"There's actual physics happening, and we need to be aware of it." Yes, maybe abstractly. However, the Spectre flaw is well above the level of physics. There ma

"There's actual physics happening, and we need to be aware of it." Yes, maybe abstractly. However, the Spectre flaw is well above the level of physics. There may be physics flaws as well (e.g., Rowhammer), but Spectre is an architectural flaw in the design of some microprocessors, in that it leaks information by e.g. cache timing attacks and non-program-state data (e.g., branch prediction tables). These can be redesigned above the physics layer.

mannykannot 9y ago
I can't speak for the author of that quote, but cache timing appears to be as much a physics phenomenon as is the behavior that allows rowhammer to work. I cannot see any point where the author implied that the solution can only be found in the physics layer.
- SomeHacker44 9y ago
  The cache timing is not a physics phenomenon. It's an isolation phenomenon. Speculative execution is loading data into the cache, exactly as designed. The instructions that used the speculatively loaded cached data were not retired, exactly as designed. Requesting that cached data later (in actually retired instructions) is faster assuming it's still cached, which is a reasonable likelihood given the locality of the access. That's the timing attack vector. There's no physics here - it's all architecturally operating as designed. That's why the design has a security flaw, and there is no physics problem here. (There may be others, elsewhere, of course, but none in Spectre or Meltdown that I am aware of.)
  - mst 9y ago
    From my POV "the locality of the access" making a speed difference is a physics phenomenon.
  - mannykannot 9y ago
    The fact that is working as designed has no bearing on the question of whether it is a physics problem. You could just as well say (as Intel's press release seemed to to be trying to imply) that there isn't a fault at all, whether physical or not, because it is working as designed. But your own description of it working as designed is within the context of a state-machine model, and in that model, there is no attack vector; that only appears when you take the physics of the implementation into account. There wouldn't even be a cache except for the temporal physics of memory access. That it works as designed is beside the point because the design did not take the physics into account. Looking at it from the other direction, how do you conclude that rowhammer does exploit a physical phenomenon, without being inconsistent about what that means?

mannykannot 9y ago

I can't speak for the author of that quote, but cache timing appears to be as much a physics phenomenon as is the behavior that allows rowhammer to work. I cannot see any point where the author implied that the solution can only be found in the physics layer.

SomeHacker44 9y ago
The cache timing is not a physics phenomenon. It's an isolation phenomenon. Speculative execution is loading data into the cache, exactly as designed. The instructions that used the speculatively loaded cached data were not retired, exactly as designed. Requesting that cached data later (in actually retired instructions) is faster assuming it's still cached, which is a reasonable likelihood given the locality of the access. That's the timing attack vector. There's no physics here - it's all architecturally operating as designed. That's why the design has a security flaw, and there is no physics problem here. (There may be others, elsewhere, of course, but none in Spectre or Meltdown that I am aware of.)
- mst 9y ago
  From my POV "the locality of the access" making a speed difference is a physics phenomenon.
- mannykannot 9y ago
  The fact that is working as designed has no bearing on the question of whether it is a physics problem. You could just as well say (as Intel's press release seemed to to be trying to imply) that there isn't a fault at all, whether physical or not, because it is working as designed. But your own description of it working as designed is within the context of a state-machine model, and in that model, there is no attack vector; that only appears when you take the physics of the implementation into account. There wouldn't even be a cache except for the temporal physics of memory access. That it works as designed is beside the point because the design did not take the physics into account. Looking at it from the other direction, how do you conclude that rowhammer does exploit a physical phenomenon, without being inconsistent about what that means?