Hardware Security & Side Channels

side channels · Spectre/Meltdown · TPM · enclaves

1:00

How timing, cache, and speculation leaks expose secrets even in correct code — and how constant-time code and hardware roots of trust defend against them.

By the end, you can

Explain what a side channel is and name four physical signals it can measure.
Describe the three-step Flush+Reload attack and identify what makes a cache hit the information-bearing event.
Explain why speculative execution's cache footprint survives a rollback and how Spectre/Meltdown exploit that.
Distinguish Meltdown (kernel memory, KPTI) from Spectre (branch predictor, retpoline) by their mechanism and mitigation.
Identify what makes a comparison function vulnerable to timing attacks and rewrite it as a constant-time comparison.
State the three rules constant-time code must obey.
Describe how TPM extend-only PCRs build a tamper-evident measured-boot chain.
Distinguish measured boot (records), secure boot (enforces), and remote attestation (proves).
Explain why enclaves alone do not prevent side-channel attacks, citing Foreshadow as evidence.

Up next in Information Theory, Cryptography & Security