I've read a lot of side channel papers like this one over the past few years. Here are some thoughts. Firstly, this new technique is probably not exploitable a

I've read a lot of side channel papers like this one over the past few years. Here are some thoughts. Firstly, this new technique is probably not exploitable against 'real' cryptographic software. A very common technique in these papers that I see all the time these days is they attack obsolete versions of libgcrypt, because old versions of this relatively obscure crypto library aren't using constant time code. All modern and patched crypto implementations that people actually use would not leak using this technique, as the paper admits at the end. And even libgcrypt was patched years ago. The version number cited in the papers never makes this clear - you have to look up the release history to realise this. Secondly, this paper is a bit unusual in the sheer number of steps that are simulated or otherwise simplified by e.g. requiring root. It's got some work to do before it's usable outside of lab condition demonstrations. OK, so the crypto attack is theoretical and wouldn't work in real life, but what about the ability to extract passwords from typing patterns? Well, if we read that part of the paper carefully we can see a rather massive caveat: all it takes is 2 threads doing stuff in the background and the signal is drowned in noise. 4 threads doing stuff cause the signal to be entirely lost. So there seems to be a simple mitigation and it's unclear that this would work at all on a server that's under even moderate load. Moreover, whilst a casual reader may get the impression they can extract passwords, they don't actually demonstrate that. Rather, they demonstrate what they claim is "a very distinguishable pattern" in ring contention triggered by keystrokes, with "zero false positives and zero false negatives". That sounds impressive but no information is given on what they're comparing against: what were the other events that were being tested here? The obvious question in my mind is how much of the signal they're seeing came from the actual keystroke vs output being printed to a terminal emulator, in which case, I'd expect to see potential FPs caused by any printing to the terminal. Their victim program doesn't merely monitor keystrokes but they are also echoed to the terminal - which is not what happens during password input, where characters aren't visible. This mock victim program is not much like a real password input program as a consequence. Overall it's a clever paper, but I find myself increasingly fatigued by this genre of research. They seem to have settled into a template: • Attack Intel, ignore everything else. • Make grand and scary sounding claims • Only demonstrate them against deliberately crippled victim programs in very artificial conditions. It's been a few years now and I don't think any Spectre attack has ever been spotted in the wild, mounted by real attackers. That's true despite a huge state-sponsored attack having just been detected, that Microsoft claim might have had over 1000 developers work on it. Uarch side channel attacks sound cool but it seems real attackers either can't make them work, or have easier ways to get what they want. I find myself losing interest as a consequence.