BlueHat v17 || Raising the Bar: New Hardware Primitives for Exploit Mitigations

Rob Turner, Qualcomm Technologies

Almost three decades since the Morris worm and we're still plagued by memory corruption vulnerabilities in C and C++ software. Exploit mitigations aim to make the exploitation of these vulnerabilities impossible or prohibitively expensive. However, modern exploits demonstrate that currently deployed countermeasures are insufficient.

In ARMv8.3, ARM introduces a new hardware security feature, pointer authentication. With ARM and ARM partners, including Microsoft, we helped to design this feature. Designing a processor extension is challenging. Among other requirements, changes should be transparent to developers (except compiler developers), support both system and application code, interoperate with legacy software, and provide binary backward compatibility. This talk discusses the processor extension and explores the design trade-offs, such as the decision to prefer authentication over encryption and the consequences of small tags.

Also, this talk provides a security analysis, and examines how these new instructions can robustly and efficiently implement countermeasures.

[samdjafari]

Is any data regarding the performance of PAC*/AUT* public? For example how many cpu cycles?