News for hackers. Stuff that matters.

A comment on Catch-23: The New C Standard Sets the World on Fire. Parent comment

Re:Catch-23: The New C Standard Sets the World on Fire by codeflo on Sunday April 02, 2023 @03:21AM (#35408054)
Of course, that's technically incorrect. The way the standards are written, the compiler is free to replace the program with any other program that has the same (in a precisely defined sense) observable behavior (these are the famous "as if" formulations in language specs). Heating up the CPU is not considered observable behavior.

If someone really just wants a delay, it's easy to either (for programs running on normal OSs) call a sleep function, or (on tiny embedded systems) add an empty inline assembler statement that the compiler can't see through.

[ Parent | on HN ]
Re:Catch-23: The New C Standard Sets the World on Fire by carlmr on Sunday April 02, 2023 @09:25AM (#35410264)
>Heating up the CPU is not considered observable behavior.

Neither is measuring delays of cached versus non-cached instructions. Yet it turns out to be very observable.

[ Parent | on HN ]
Re:Catch-23: The New C Standard Sets the World on Fire by codeflo on Sunday April 02, 2023 @10:28AM (#35410821)
Of course these things are “observable” in the literal sense. And yet, they aren’t considered to be observable by the memory model of any language spec that I know of. Same as CPU power draw, which has been used as a side-channel to extract bits of crypto keys, and is very much influenced by common optimizations.

Practically, if you need to execute a specific sequence of machine instructions in order to prevent side-channel attacks, then you have to rely on assembler, compiler intrinsics and/or OS support. But that was true way before Spectre.

[ Parent | on HN ]