Metraipolis › archive › dc_cdbfb15ee45f

PhotoFinish: Portable Timerless Probing of Microarchitectural Latencies — arXiv:2611.09879

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.09879
License (as archived): CC0-1.0
Archived: 2026-11-09T22:40:36.601Z
SHA-256 of the archived text: be499fe8dfb3edf7b262857124cd0d26d61dc3fd3aa102d5a0e716fd7fc4a5a3
Stable URL of this page: https://metraipolis.com/documento/dc_cdbfb15ee45f

How to cite

PhotoFinish: Portable Timerless Probing of Microarchitectural Latencies — arXiv:2611.09879 — arXiv (en), https://arxiv.org/abs/2611.09879 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_cdbfb15ee45f (Metraipolis archive dc_cdbfb15ee45f, sha256 be499fe8dfb3edf7b262857124cd0d26d61dc3fd3aa102d5a0e716fd7fc4a5a3)

BibTeX

@misc{dccdbfb15ee45f,
  title = {PhotoFinish: Portable Timerless Probing of Microarchitectural Latencies — arXiv:2611.09879},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.09879},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_cdbfb15ee45f; sha256 be499fe8dfb3edf7b262857124cd0d26d61dc3fd3aa102d5a0e716fd7fc4a5a3},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.09879. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Timing measurements are a fundamental building block of microarchitectural attacks, enabling software to convert otherwise invisible latency differences into architectural observations. Thus, restricting high-resolution timers is a common defense, especially in constrained environments such as web browsers. Timerless probing primitives provide an alternative approach. Instead of reading or constructing a timer, they observe architectural events that correlate with the microarchitectural state. However, such primitives typically rely on platform-specific behavior, and none generalizes across the wider computing landscape. In this paper, we present PhotoFinish, a portable timerless probing primitive that converts latency differences directly into an architectural value. PhotoFinish races an operation under test against a fixed reference in two parallel threads that then write unique values to the same shared location, resulting in a latency-dependent architectural value. PhotoFinish only requires parallel execution and shared memory, without constructing or reading a clock. We evaluate PhotoFinish on 38 CPUs spanning four ISAs and demonstrate reliable cache state classification across widely different microarchitectures, with comparable fidelity when compiled to WebAssembly and executed inside a browser. We further use PhotoFinish in AES T-table and Evict+Reload attacks, show that it applies beyond caches to TLB and execution-engine latencies, and demonstrate sufficient precision to identify the LLC slice of an address. Our results demonstrate shared-memory races as a generic and precise replacement for explicit timing, showing that restricting timers alone does not prevent software from observing fine-grained microarchitectural latency differences.

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2611.09879 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-09T22:33:17.040Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).