3 ms·
yes, I meant that to suffer from spectre you just need a shared cache; it's not necessary to share address space. It follows from what a cache is. You have a l
by ithkuil 9y ago
yes, I meant that to suffer from spectre you just need a shared cache; it's not necessary to share address space.
It follows from what a cache is. You have a large set of numbers (memory addresses) mapping into a smaller set of numbers (cache lines); my necessity there will be a collision.
The mapping is deterministic and you can recover information by looking at these clashes.
Some intel high end CPUs have a feature called CAT which was designed to avoid that different workloads interfere too much by stomping on each other's cache lines, but I think it's meant mostly as a performance feature not a security feature (although there is some research about how to use it to defend from cache-based side channels, see http://palms.ee.princeton.edu/system/files/CATalyst_vfinal_correct.pdf http://palms.ee.princeton.edu/system/files/CATalyst_vfinal_c... and https://arxiv.org/pdf/1708.09538.pdf https://arxiv.org/pdf/1708.09538.pdf).
Another possible approach is to make it harder to predict the mapping between a physical address (or an address delta) and a cache line.
I don't know if using a cryptographic-grade mapping for hardware cache would be even remotely feasible nor whether it would actually solve the problem of information leak.