3 ms·

What exactly do you mean by capability based addressing Vs capability object model? Is it the use of capabilities to grant access to particular chunks of memory

What exactly do you mean by capability based addressing Vs capability object model? Is it the use of capabilities to grant access to particular chunks of memory? What do you see as the pros and cons?

nickpsecurity 7y ago
This free book is probably best place to start: http://www.cs.washington.edu/homes/levy/capabook/index.html http://www.cs.washington.edu/homes/levy/capabook/index.html The surviving, capability architecture is System/38 -> AS/400 -> IBM i. A side effect of better architecture is that they are also incredibly reliable. One person here described them as the tanks of their company's servers.
willvarfar 7y ago
The Object Capability Model https://en.wikipedia.org/wiki/Object-capability_model https://en.wikipedia.org/wiki/Object-capability_model is the general approach of tracking priviledges at a fine grain. Capability-based addressing https://en.wikipedia.org/wiki/Capability-based_addressing https://en.wikipedia.org/wiki/Capability-based_addressing is hardware that implements 'fat pointers' that point to ranges of memory so its not possible for a program to address memory it shouldn't. Basically, it forces programs to be 'memory safe' https://en.wikipedia.org/wiki/Memory_safety https://en.wikipedia.org/wiki/Memory_safety even if written in memory-unsafe languages such as C.
sebcat 7y ago
Reposting this from the other day: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ Paper: https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201406-isca2014-cheri.pdf https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201406... "Motivated by contemporary security challenges, we reevaluate and refine capability-based addressing for the RISC era. We present CHERI, a hybrid capability model that extends the 64-bit MIPS ISA with byte-granularity memory protection."

What exactly do you mean by capability based addressing Vs capability object model? Is it the use of capabilities to grant access to particular chunks of memory? What do you see as the pros and cons?

nickpsecurity 7y ago

This free book is probably best place to start: http://www.cs.washington.edu/homes/levy/capabook/index.html http://www.cs.washington.edu/homes/levy/capabook/index.html The surviving, capability architecture is System/38 -> AS/400 -> IBM i. A side effect of better architecture is that they are also incredibly reliable. One person here described them as the tanks of their company's servers.

willvarfar 7y ago

The Object Capability Model https://en.wikipedia.org/wiki/Object-capability_model https://en.wikipedia.org/wiki/Object-capability_model is the general approach of tracking priviledges at a fine grain. Capability-based addressing https://en.wikipedia.org/wiki/Capability-based_addressing https://en.wikipedia.org/wiki/Capability-based_addressing is hardware that implements 'fat pointers' that point to ranges of memory so its not possible for a program to address memory it shouldn't. Basically, it forces programs to be 'memory safe' https://en.wikipedia.org/wiki/Memory_safety https://en.wikipedia.org/wiki/Memory_safety even if written in memory-unsafe languages such as C.

sebcat 7y ago

Reposting this from the other day: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ Paper: https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201406-isca2014-cheri.pdf https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201406... "Motivated by contemporary security challenges, we reevaluate and refine capability-based addressing for the RISC era. We present CHERI, a hybrid capability model that extends the 64-bit MIPS ISA with byte-granularity memory protection."