Hacker News Reader

Hacker News

Comment by cperciva | Hacker News Reader

Parent Full thread

cperciva

first to come up with microarchitectural attacks

I'm not saying that. There are definitely earlier attacks which exploit microarchitectural features (including caches).

What I am saying is that as far as I'm aware I'm the first person to demonstrate an attack consisting of

1. Information being leaked from a process into the microarchitectural state of the CPU, followed by

2. That information being retrieved by another process.

This is the model which the vast majority of attacks over the past decade have followed, and it's the model which Spectre/Meltdown make use of.

View on HN

That's a much more defensible claim---one I have no issue with---but it was easy to misread the post and believe it was claiming something more general.

Thanks! It's getting late here (3 AM) so this might not be the best wording, but would it help if I added a note after the third paragraph along the lines of "Note that there have been previous side channel attacks which depended on how microarchitectural features (usually caches) affected code execution; but my work was the first to demonstrate information leaking from a program into the microarchitectural state and then being extracted from there." ?

(Feel free to suggest other wording too -- as I said, it's getting late here and my word-putting-together skills are currently subpar.)

That seems fine on its own, but it somewhat undermines the paragraph with "but they have all followed the same basic mechanism", seeing as these earlier attacks relying on caches etc did not follow this mechanism. Changing "all" to "most" or "many" would probably suffice.

Ah, that should have said over the following years.

I think Meltdown can be best characterised as being the same process that leaks and retrieves the information. The bug being that a process is able to leak data into the micro-architectural state that it isn't allowed to read directly.

Fair enough. The point remains, information is leaking into the microarchitectural state and then being extracted from there -- quite different from earlier attacks which simply exploited the fact that the microarchitecture resulted in certain operations during a cryptographic computation being faster or slower depending on the data being handled.

Reply on news.ycombinator.com