Earlier quoted context omitted.
What is the analogy behind being able to go into the restricted room?
You can call into the kernel. edit: s/call into/trigger a syscall/
You don't even need to do that for meltdown.
Reading privileged memory with a side-channel
631–639 of 639 posts
Re: Reading privileged memory with a side-channel
#632An analogy that was useful for explaining part of this to my (non-technical) father. Maybe others will find it helpful as well. Imagine that you want to know whether someone has checked out a particular library book. The library refuses to give you access to their records and does not keep a slip inside the front cover. You can only see the record of which books you have checked out. What you do is follow the person…
Fantastic explanation of cache timing attacks. This morning I was explaining spectre to non-technical people and let me tell you, "leaking L1 CPU cache memory," is a real party starter. So I'm using there librarian example going forward.
I used your explanation in a longer note, "Spectre: How do side-channel attacks work?"[^1] to try and explain how side-channel attacks work (partly to myself, and partly to non-hackers).
[^note]: https://www.facebook.com/notes/petrus-theron/spectre-how-do-...
Re: Reading privileged memory with a side-channel
#633Earlier quoted context omitted.
What is the analogy behind being able to go into the restricted room?
The restricted room is the part of the machine behind the protection. Memory reads are not checked at the tine access. They are checked when the instruction retires.
On intel* this isn’t a property intrinsic to superscalar processors, other architectures check it in flight or while it’s in the issue queue, preventing this side channel.
Re: Reading privileged memory with a side-channel
#634Earlier quoted context omitted.
This is a general explanation of side channel attacks, as I understand.
A timing attack is one type of side channel attack. These types of timing attacks can also be used against poor/unsuitable crypto functions, or even some processes involving general computation e.g. If it takes longer to reject input A than input B, you can reason that input A is closer to the answer (similar to someone reading a paragraph until they reach the first error). Other side-channel attacks can come in the…
Is blinding the only real solution to most of these attacks against Crypto?
Re: Reading privileged memory with a side-channel
#635Earlier quoted context omitted.
What you are describing is sinply plain associative memory. If I remember correctly, this is complex in its imolementation, but does not grow exponentially. Plesse correct me if I am wrong.
fully associative memory is generally very power hungry. Thats why in CPU's caches are usually "2 way associative" or "4 way associative". That means the data you're looking for might be in one of 2 (or 4) places. Fully associative means the data you're looking for might be in any memory slot, and you're gonna have to check them all. Checking them all in parallel is possible, so it isn't a speed issue, but it is a ma…
Associative memory is a huge matrix of and gates in the comparator. But we are talking about buffering results of speculated reads after a predicted branch.
The density if load instructions in code is not particularly high on average. Also, all loads are subject to the same latencies, so that the chance that a speculative read completes before the blocking one is also low (must be cached in a higher level cache, I think).
Taken together, I would be surprised if more than about 10 speculative reads can successfully complete at all in that time frame, even though it is hundreds of cycles. So that would be around 1000 and gates and 1000 memory cells. Doesn't sound too big to me.
Re: Reading privileged memory with a side-channel
#63612343
Re: Reading privileged memory with a side-channel
#6372134d
Re: Reading privileged memory with a side-channel
#638Earlier quoted context omitted.
Fantastic explanation of cache timing attacks. This morning I was explaining spectre to non-technical people and let me tell you, "leaking L1 CPU cache memory," is a real party starter. So I'm using there librarian example going forward.
I used your explanation in a longer note, "Spectre: How do side-channel attacks work?"[^1] to try and explain how side-channel attacks work (partly to myself, and partly to non-hackers). [^note]: https://www.facebook.com/notes/petrus-theron/spectre-how-do-...
Thanks for the heads up!
Re: Reading privileged memory with a side-channel
#639Earlier quoted context omitted.
This whitepaper describes the Javascript exploit in Section IV. I'm struggling to understand it though: http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf
This too was provided as a proof of concept (without explanation): https://brainsmoke.github.io/misc/slicepattern.html . I'm not sure what I'm looking at though
This is the first implementation in Javascript I have seen so far: http://xlab.tencent.com/special/spectre/js/check.js