Re: ARM is channeling the IBM 360

In article <bebb9f88a6677b4894478a3dabc8b2c9@www.novabbs.org>,
mitchalsup@aol.com (MitchAlsup1) wrote:

The 4 seconds part leads me to believe the attackers are using brute
force, since in 4 seconds one can try something like 2^28 patterns.

Makes sense: there's probably a hash of the block address involved in
generating those 4-bit tags, and they're brute-forcing the salt.

Memory Tagging Extension doesn't seem to have been heavily used as yet,
which may be why ARM aren't very worried about it.

Pointer Authentication Code in ARMv8.3 is usable within functions, but
has problems, in that compilers can't readily tell if stored pointers
have PAC signatures.

Branch Target Indicators in ARMv8.5 work quite well, but need linker and
loader support.

PAC and BTI use instructions that are no-ops in earlier versions of ARM64,
but you really ought to test that they work before releasing binaries
that include them. I've done that on Android, where I had the combination
of hardware, OS and compiler to do it.

Once I can get an ARM Linux server with the hardware support, Linux
kernel 5.0 onwards and modern GCC will let me do it there. Windows and
macOS on ARM both lack some pieces, and iOS requires you to change ABIs
and drop support for older 64-bit devices.

John