X86 is a high-level language

Post by kazinator » Wed, Mar 25, 2015, 9:46 PM UTC

scott_s wrote: post #43

kazinator wrote: post #32

Earlier quoted context omitted.

But what x86 can express hasn't changed; just how it performs. An abstraction never includes the details of execution; abstraction is that separation itself! A piece of 80386 code running on an 80386 is no more or less abstract than the same piece of code on a Core i7. They agree in their external effects, like what inputs are loaded from memory, and what result is written. The fact that EAX is renamed to different i…

It used to be that the x86 instruction set was representative of the processor architecture that it programmed. That is no longer the case. Now, it is valid to view the x86 instruction set as an abstraction of the processor architecture. That is, you can mostly pretend that the processor you're programming for is accurately represented by the architecture implied by the x86 instruction set, but it is not. And when it…

Post by rdtsc » Wed, Mar 25, 2015, 9:50 PM UTC

sdevlin wrote: post #49

Animats wrote: post #36

Earlier quoted context omitted.

That's true of all superscalar machines. That's what killed RISC. The original idea of RISC was one instruction per clock and a very simple CPU control section. Early MIPS CPUs realized that. Then superscalar came to microprocessors with the Pentium Pro. It took 3000 engineers at Intel to design that CPU, but it did much better than one instruction per clock while still handling all the weird cases in x86 instruction…

RSA is not "modern". Modern elliptic curves are chosen with side channels in mind. You won't find data-dependent branches or look-ups in straightforward implementations of Curve25519 scalar multiplication, for example.

Post by mreiland » Wed, Mar 25, 2015, 9:56 PM UTC

jlebar wrote: post #41

jstarks wrote: post #28

The author's conclusion that side channel attacks are unpreventable because x86 instructions execute in a variable amount of time does not follow. Side channel attacks that rely on variable instruction timing rely on _content-dependent_ timing. For example, the time spent for a mov from a memory location does not depend on the contents of the memory, but it does depend on the address of that memory. If that address i…

> The fact that xor eax,eax is just a register operation doesn't mean it can leak sensitive information. AIUI tfa's point is that you can't assume that xor eax,eax and xor eax,ebx take the same amount of time, because "x86 is a high level language". Similarly for his other examples. This, he claims, makes it difficult to write code that resists timing attacks, if you ever want to have a branch that does nothing. Thus…

Post by mreiland » Wed, Mar 25, 2015, 10:13 PM UTC

matthewmacleod wrote: post #31

chaosphere2112 wrote: post #22

Earlier quoted context omitted.

What if, instead of a random sleep, you have a defined period of time for a function to take– you take a clock reading at the start and end of your execution, and sleep the remainder of the execution time?

The problem there is that sleeping alters the performance characteristics of your system. If an attacker submits multiple requests simultaneously, it would be possible for them to determine if you were actually working, or just sleeping - and you're back to leaking. Sure, every confounding factor makes it more difficult to extract information. But there are many effective techniques for doing so, and we keep getting…

Post by bmm6o » Wed, Mar 25, 2015, 10:16 PM UTC

rdc12 wrote: post #76

One of the links on the post, links to a stack overflow question, that has this code. What is the purpose of the do-while loop with the condition 0, how is that different to not having the loop at all? #define BN_CONSTTIME_SWAP(ind) \ do { \ t = (a->d[ind] ^ b->d[ind]) & condition; \ a->d[ind] ^= t; \ b->d[ind] ^= t; \ } while (0)