Which correctly describes the mechanism of Arm pointer authentication (PAC)?

Answer: B. A short authentication code is computed from the pointer value and a context value with a key inside the CPU, placed in the pointer's upper bits and checked before use

In the upper bits of a 64-bit pointer that are not used for the virtual address, an authentication code computed with a key inside the CPU from the pointer value and a context value (for example the stack pointer) is inserted. Just before a function's return address or similar is used, a dedicated instruction recomputes and compares it and, on a mismatch, turns the pointer into an unusable address, which makes attacks that overwrite return addresses on the stack (such as ROP) harder. Software cannot read the key, so an attacker cannot produce an authentication code that matches a modified pointer. However, the length of the code depends on settings such as the virtual address width and is often a dozen or so bits or fewer, so where many guesses are possible, the probability of a chance match has to be considered.

• A. Asking the OS every time would be extremely slow. The check is done with CPU instructions.
• B. Correct. An attacker who does not know the key cannot produce an authentication code that matches a modified pointer.
• C. The pointer value itself is not encrypted. The address part is left as it is and an authentication code is added in the upper bits.