4 ms·
There's also the matter that they keep adding things to the list. Remember three years ago when we didn't know we had to worry about Spectre?
by zrm 6y ago
There's also the matter that they keep adding things to the list. Remember three years ago when we didn't know we had to worry about Spectre?
- ljhsiung 6y agoMinor nitpick, but "three years ago" the crypto world still did "worry" about Spectre and general transient execution attacks [1][2][3][4]. To me, the biggest thing about Spectre et al. wasn't the proof that CPU uArch can negatively impact security. Rather, it's the proof of information leakage from other processes and privilege modes, which is a drastically heightened vector than cryptography. [1] https://ts.data61.csiro.au/projects/TS/cachebleed/ https://ts.data61.csiro.au/projects/TS/cachebleed/ https://ts.data61.csiro.au/projects/TS/cachebleed/ https://ts.data61.csiro.au/projects/TS/cachebleed/ [2] On Subnormal Floating Point and Abnormal Timing https://cseweb.ucsd.edu/~dkohlbre/papers/subnormal.pdf https://cseweb.ucsd.edu/~dkohlbre/papers/subnormal.pdf [3] Predicting Secret Keys via Branch Prediction https://eprint.iacr.org/2006/288.pdf https://eprint.iacr.org/2006/288.pdf [4] Exploiting I-Cache https://eprint.iacr.org/2007/164.pdf https://eprint.iacr.org/2007/164.pdf