> That time they had no idea about the upcoming cache exploits, they were only apparent to me. So who was right? I don't see anything that suggests you did hav

> That time they had no idea about the upcoming cache exploits, they were only apparent to me. So who was right? I don't see anything that suggests you did have an idea about "upcoming cache exploits", so I'm afraid I can't say that you were. I saw you mentioning something that would help, but was nowhere near enough, to deal with Spectre, which was then dealt with by microcode, kernels and every other part of the software stack, making attacking libsodium with Spectre something that might not even be possible. > The tradeoff they are talking about is leaving secrets in the cache, because mb(lb) is slow. This is not acceptable for security, only for performance. Not entirely. The main reason is this one: > SPECTRE-like attacks can be conducted during all the time the secret is present, prior to zeroing. The required preconditions and the time window during which a full memory barrier could help, seem to be negligible compared to the actual lifetime of the secret.