Date: Wed, 9 Sep 2015 22:26:54 +0200 From: Szabolcs Nagy <nsz@...t70.net> To: Zack Weinberg <zackw@...ix.com> Cc: Paul_Koning@...l.com, dje.gcc@...il.com, gcc@....gnu.org, libc-alpha@...rceware.org, musl@...ts.openwall.com Subject: Re: Compiler support for erasure of sensitive data * Zack Weinberg <zackw@...ix.com> [2015-09-09 15:03:50 -0400]: > On 09/09/2015 02:02 PM, Paul_Koning@...l.com wrote: > >> On Sep 9, 2015, at 1:54 PM, David Edelsohn <dje.gcc@...il.com> > >> wrote: > >> > >> What level of erasure of sensitive data are you trying to ensure? > >> Assuming that overwriting values in the ISA registers actually > >> completely clears and destroys the values is delusionally naive. > > > > Could you point to some references about that? > > I *assume* David is referring to register renaming, which is not > architecturally visible... > or async signal handler copying all the register state on sigaltstack or internal counters and debug features making sensitive info observable or timing/cache-effect side channels that let other processes get info or compiling to a highlevel language (js) with different kind of leaks or running under emulator/debugger that can make secrets visible or... > I would consider data leaks via state inaccessible to a program > executing at the same privilege level as the code to be hardened to be > out of scope. (Which does mean that *when hardening an OS kernel* one specifying the info leak at the abstract c machine level is not useful (the memset is not observable there, unless you assign meaning to undefined behaviour which is a can of worms), but you do have to specify the leak on some abstraction level (that is applicable to the targets of a compiler and gives useful security properties in practice) otherwise the attribute is not meaningful. leaks can happen for many reasons that are layers below the control of the compiler, but still observable by high level code.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.