3 ms·
This may sound stupid, but the commonality in all these side channel attacks is that high precision time keeping is a non privileged operation. Maybe it’s time
by juancn 5y ago
This may sound stupid, but the commonality in all these side channel attacks is that high precision time keeping is a non privileged operation.
Maybe it’s time to make clocks a privileged op as a mitigation. Even making execution time non predictable on untrusted code, such as JavaScript?
If precise time keeping is unavailable these become harder to do.
- lukastr0 5y agoIt is surprisingly difficult to make timekeeping unavailable. There are many methods, besides the official timer APIs, to get timing - as outlined in the paper "Fantastic Timers and where to find them" from TU Graz: https://www.researchgate.net/publication/322000263_Fantastic_Timers_and_Where_to_Find_Them_High-Resolution_Microarchitectural_Attacks_in_JavaScript https://www.researchgate.net/publication/322000263_Fantastic...