Hardware-Software Codesign for Mitigating Spectre
summary
Claims a provably correct mitigation for data-oblivious (constant-time) code called Serberus, implemented as LLVM passes (fence insertion, function-private stacks, register cleaning) and targeting existing x86 features (Intel CET and PSFD). Serberus yields about 6.4% average overhead on crypto benchmarks including OpenSSL but explodes to >300% on SPEC due to coarse-grain fences; preliminary hardware support via a no-spec instruction prefix reduces overhead to ~15% in initial experiments and promises further gains.
AI-written summary · about
chapters (4)
related talks
56mSpectre/C++
46mRethinking Architectures and Abstraction for a World Where Security Improvements Matter More than Performance Gains
33mGhosting the Spectre
01h 13mHardware-Software Contracts for High Assurance with Applications to Side-Channel Security
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
01h 03mBPF and Spectre: Mitigating transient execution attacks
23mSecure Composition of SPECTRE Mitigations
19mDo You Even Lift? Strengthening Compiler Security Guarantees Against Spectre Attacks