4 ms·

first to come up with microarchitectural attacks I'm not saying that. There are definitely earlier attacks which exploit microarchitectural features (includin

first to come up with microarchitectural attacks I'm not saying that. There are definitely earlier attacks which exploit microarchitectural features (including caches). What I am saying is that as far as I'm aware I'm the first person to demonstrate an attack consisting of 1. Information being leaked from a process into the microarchitectural state of the CPU, followed by 2. That information being retrieved by another process. This is the model which the vast majority of attacks over the past decade have followed, and it's the model which Spectre/Meltdown make use of.

caf 9y ago
I think Meltdown can be best characterised as being the same process that leaks and retrieves the information. The bug being that a process is able to leak data into the micro-architectural state that it isn't allowed to read directly.
- cperciva 9y ago
  Fair enough. The point remains, information is leaking into the microarchitectural state and then being extracted from there -- quite different from earlier attacks which simply exploited the fact that the microarchitecture resulted in certain operations during a cryptographic computation being faster or slower depending on the data being handled.
pbsd 9y ago
That's a much more defensible claim---one I have no issue with---but it was easy to misread the post and believe it was claiming something more general.
- cperciva 9y ago
  Thanks! It's getting late here (3 AM) so this might not be the best wording, but would it help if I added a note after the third paragraph along the lines of "Note that there have been previous side channel attacks which depended on how microarchitectural features (usually caches) affected code execution; but my work was the first to demonstrate information leaking from a program into the microarchitectural state and then being extracted from there." ? (Feel free to suggest other wording too -- as I said, it's getting late here and my word-putting-together skills are currently subpar.)
  - pbsd 9y ago
    That seems fine on its own, but it somewhat undermines the paragraph with "but they have all followed the same basic mechanism", seeing as these earlier attacks relying on caches etc did not follow this mechanism. Changing "all" to "most" or "many" would probably suffice.
    - cperciva 9y ago
      Ah, that should have said over the following years.

caf 9y ago

I think Meltdown can be best characterised as being the same process that leaks and retrieves the information. The bug being that a process is able to leak data into the micro-architectural state that it isn't allowed to read directly.

cperciva 9y ago
Fair enough. The point remains, information is leaking into the microarchitectural state and then being extracted from there -- quite different from earlier attacks which simply exploited the fact that the microarchitecture resulted in certain operations during a cryptographic computation being faster or slower depending on the data being handled.

pbsd 9y ago

That's a much more defensible claim---one I have no issue with---but it was easy to misread the post and believe it was claiming something more general.

cperciva 9y ago
Thanks! It's getting late here (3 AM) so this might not be the best wording, but would it help if I added a note after the third paragraph along the lines of "Note that there have been previous side channel attacks which depended on how microarchitectural features (usually caches) affected code execution; but my work was the first to demonstrate information leaking from a program into the microarchitectural state and then being extracted from there." ? (Feel free to suggest other wording too -- as I said, it's getting late here and my word-putting-together skills are currently subpar.)
- pbsd 9y ago
  That seems fine on its own, but it somewhat undermines the paragraph with "but they have all followed the same basic mechanism", seeing as these earlier attacks relying on caches etc did not follow this mechanism. Changing "all" to "most" or "many" would probably suffice.
  - cperciva 9y ago
    Ah, that should have said over the following years.