English
Menu

Hardware Security: Advanced Topics and Trends

Which correctly pairs the descriptions of retpoline and IBRS, countermeasures against the Spectre variant that abuses indirect branch prediction (branch target injection)?

  1. ARetpoline rebuilds the CPU circuits to remove the predictor, and IBRS is a countermeasure in which the compiler rewrites indirect branch instructions into another sequence of instructions
  2. BRetpoline is a software countermeasure that replaces indirect branches with instruction sequences that do not rely on the predictor, and IBRS is a CPU feature that restricts indirect branch prediction
  3. CBoth retpoline and IBRS stop the CPU's speculative execution itself, so with either of them the performance gained from speculative execution is lost
Show answer and explanation

Answer: B. Retpoline is a software countermeasure that replaces indirect branches with instruction sequences that do not rely on the predictor, and IBRS is a CPU feature that restricts indirect branch prediction

With retpoline, the compiler replaces indirect branch instructions with a sequence combining call and ret, making the CPU use return prediction instead of the abusable indirect branch predictor and letting speculative execution spin harmlessly in a loop. IBRS is a CPU control feature added through microcode updates and the like that restricts, for example, indirect branch prediction in the kernel so that it does not follow what user programs have trained. On older CPUs, toggling IBRS took a lot of time, so retpoline was widely used, while newer CPUs provide an improved version that can be left on permanently (eIBRS). However, some CPUs also rely on another predictor for return prediction, and Retbleed, published in 2022, among others, showed cases where retpoline alone is insufficient.

  • A. It is the other way round. Retpoline is a software countermeasure applied by the compiler and IBRS is a CPU feature.
  • B. Correct. One avoids the predictor in software, the other restricts prediction with a CPU feature.
  • C. Neither removes speculative execution itself; they avoid or restrict the predictions that could be abused.
Practice this topic Back to topic

Books on Hardware Security: Advanced Topics and Trends Ad

As an Amazon Associate I earn from qualifying purchases.

More Hardware Security: Advanced Topics and Trends questions

  1. A task took 10 seconds before mitigations for speculative execution were applied and made 5 million system calls during that time. Assume that the mitigations increase the processing time per system call from 0.4 µs to 0.6 µs and leave the time of everything else unchanged. By what proportion does the total time of the task increase?
  2. Lattice-based post-quantum cryptography repeatedly multiplies polynomials of degree n = 256. If the naive method of multiplying every pair of coefficients needs about n² multiplications and the method using the number-theoretic transform (NTT) needs about n log₂ n, which is closest to the factor by which the NTT reduces the number of multiplications?
  3. The public key of ML-KEM-768 is 1,184 bytes and its ciphertext 1,088 bytes, while the public value of the elliptic-curve key exchange X25519 is 32 bytes. How many times larger than the X25519 public value is the ML-KEM-768 public key?
  4. In ML-KEM decapsulation, the ciphertext is rebuilt from the result of decrypting the received ciphertext with the private key and compared with the received ciphertext. Which is a correct implementation precaution for this part?
  5. You are designing an SoC for an embedded device that will be used for more than 10 years. Which is an appropriate hardware and firmware design to prepare for future cryptographic migration (such as the move to post-quantum cryptography)?