SecDMP stops data-memory prefetcher leakage at low cost
Original title: SecDMP: Provably Secure Data Memory-Dependent Prefetching (Extended Version)
Marked secrets stay out of the prefetcher; with speculative defenses, constant-time code is fully protected.
The paper classifies leakage from data memory-dependent prefetchers and shows they can expose secrets even from Spectre-hardened constant-time code. Open-source DMP implementations on a RISC-V processor show one performance-preserving defense misses entire leakage classes. SecDMP requires secrets to be marked in memory and is proved to add no leakage beyond a no-DMP baseline, with minimal overhead and hardware cost.
Unconfirmed: Prevention of all DMP leakage is the authors' formal claim and evaluation.
- DMPs are used in mainstream desktop and server CPUs.
- SecDMP does not encode marked secrets in the microarchitecture.
- Public-data prefetch performance is preserved.
- Authors report prevention of all tested DMP leakage classes.
Impact: Side-channel leakage of secrets via data prefetchers
| Product | Affected |
|---|---|
| data memory-dependent prefetchers | — |
From the original article
1 min read at arxiv.orgData memory-dependent prefetchers (DMPs) are a microarchitectural optimization recently introduced in mainstream desktop and server CPUs. Although DMPs offer performance improvements, they have been shown to enable side-channel leakage of secrets, even from constant-time code that has been hardened against Spectre attacks.
By Jens Sprengers · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.