Pointer Authentication

I’m guessing this was developed by or at the behest of Apple and ARM, based off the supported hardware and languages? Are any versions of the iOS or macOS kernel (or even user lands) utilizing this “across the board” now? I’d read papers and theory on strong pointer authentication to mitigate control flow attacks a very long time ago but I did not realize this was now “mainstream” in a consumer compiler (with support for multiple C-like languages to boot!); but it certainly is a tough sell without hardware support, both for security and (perceived) performance benefits. (I say perceived because it turns out that a lot of runtime safety checks are actually virtually undetectable as they are perfect fits for speculative execution and branch prediction, and very easily guessable with high success rates, as demonstrated by the rust benchmarks with and without runtime safety checks enabled having such close performance on modern x86_64 architectures.)

ARMv8.3 shipped with the instructions needed for this implementation of signed pointers in 2016, and presumably Apple played a good role in contribution this feature to the Clang codebase as no other hardware-accelerate authentication scheme is supported, per the document. I wonder if there are any plans to bring this to the desktop, by either of Intel or AMD. AMD is now in a position to actually develop new extensions rather than largely playing catch-up to Intel’s extensions (in recent years). (Then again, AMD remains the only one to really offer hardware acceleration for SHA [0], and that doesn’t seem to have really motivated developers to take advantage of that code.)

[0]: https://neosmart.net/blog/2017/will-amds-ryzen-finally-bring...

Does anyone here know how this compares to hwasan?

HWASAN detects against spatial and temporal memory errors; i.e. you have a pointer to memory that gets freed, and use it again (temporal), or a stack overrun into nearby memory (spatial).

Pointer Authentication is used to sign pointers to give them a kind of provenance, but it's largely used to protect against code reuse/control flow attacks (ROP is much more difficult because you cannot re-use arbitrary gadgets in the executable; the stack pointer is part of the pointer signature, so screwing with it results in termination if the signature doesn't check out.)

They are both complimentary; you could use them both. HWASAN (using memory tagging) and pointer authentication use the unused upper bits of a virtual address to store their metadata. They are compatible, but this does mean combining them reduces the overall amount of bits available for pointer signatures.

There is a recent paper discussing the use of pointer authentication to build more advanced defenses; it looks like it's worth a read, and some comparisons (including HWASAN) are available in Section 8: https://www.usenix.org/system/files/sec19fall_liljestrand_pr...

that is exactly what an MMU is for.

Yes, absolutely. There are a lot of possible approaches in this design space, but recent CPUs from ARM can do this using memory tagging at a much finer granularity than process-wide. I don't think any silicon is actually shipping with this feature yet, unfortunately.