4 ms·
Minor nitpick, but "three years ago" the crypto world still did "worry" about Spectre and general transient execution attacks [1][2][3][4]. To me, the biggest
by ljhsiung 6y ago
Minor nitpick, but "three years ago" the crypto world still did "worry" about Spectre and general transient execution attacks [1][2][3][4].
To me, the biggest thing about Spectre et al. wasn't the proof that CPU uArch can negatively impact security. Rather, it's the proof of information leakage from other processes and privilege modes, which is a drastically heightened vector than cryptography.
[1] https://ts.data61.csiro.au/projects/TS/cachebleed/ https://ts.data61.csiro.au/projects/TS/cachebleed/ https://ts.data61.csiro.au/projects/TS/cachebleed/ https://ts.data61.csiro.au/projects/TS/cachebleed/
[2] On Subnormal Floating Point and Abnormal Timing https://cseweb.ucsd.edu/~dkohlbre/papers/subnormal.pdf https://cseweb.ucsd.edu/~dkohlbre/papers/subnormal.pdf
[3] Predicting Secret Keys via Branch Prediction https://eprint.iacr.org/2006/288.pdf https://eprint.iacr.org/2006/288.pdf
[4] Exploiting I-Cache https://eprint.iacr.org/2007/164.pdf https://eprint.iacr.org/2007/164.pdf