SCHERI: Provably Secure Speculation Under the Constant-Time Policy for CHERI (Extended Version)
Researchers formally prove existing CHERI speculation proposals leak secrets and present SCHERI, a processor design with end-to-end Spectre-resistant constant-time guarantees.
The paper builds a formal framework reasoning jointly about capability safety, speculative execution, and information-flow security on CHERI architectures. It demonstrates that existing secure-speculation proposals fail to preserve constant-time confidentiality guarantees and can transiently leak isolated secrets. The authors present SCHERI, a new processor design formally proven to provide end-to-end secure speculation for the constant-time policy, resilient to Spectre attacks.
- Formal framework unifies capability safety, speculation, and information-flow security
- Existing CHERI speculation proposals shown to transiently leak secrets
- SCHERI provably guarantees secure speculation under constant-time policy
- Provides design guidance for future Spectre-resilient capability processors
From the original article
1 min read at arxiv.orgCapability-based architectures such as CHERI provide strong support for the architectural isolation of software components. To additionally protect against microarchitectural leakage, software can be written in a constant-time fashion. Modern processors, however, rely heavily on speculative execution, which can invalidate the constant-time guarantees and leak isolated secrets transiently.
By Shixin Song · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.