Technical Analysis of ARM Pointer Authentication Code (PAC) Security Feature
By
todsacerdoti
Sesame, salt, and substance. A flagship bake.
Summary
This technical article provides an in-depth exploration of Pointer Authentication Code (PAC), an ARM architecture security feature that signs pointers to prevent memory corruption exploits. The content explains how PAC works on Armv8.3-A and Armv9.0-A architectures, detailing the cryptographic signing of pointers, virtual addressing mechanisms, and canonical address structures. It covers technical implementation details including how pointers are validated at runtime and the distinction between user-mode and kernel-mode addresses based on bit patterns in 64-bit addressing.
Key quotes
· 3 pulledPointer Authentication Code, or PAC, is an anti-exploit/memory-corruption feature that signs pointers so their use (as code or data) can be validated at runtime.
PAC is available on Armv8.3-A and Armv9.0-A (and later) ARM architectures and leverages virtual addressing in order to store a small cryptographic signature alongside the pointer value.
On a typical 64-bit processor a pointer is considered a 'user-mode' pointer if bit 47 of a 64-bit address is set to 0 (meaning, then, bits 48-63 are also 0). This is known as a canonical user-mode address.
You might also wanna read
KERNHELM: Plan-Bound Authorization Architecture for Governing Privileged Effects in Untrusted AI Agents
The article presents KERNHELM, a plan-bound authorization architecture designed to govern privileged effects in untrusted computational agen
github.com·3mo ago
Technical Analysis of macOS Boot Chain and Security Architecture on Apple Silicon
This technical article provides a comprehensive reverse engineering analysis of the macOS boot chain and security architecture on Apple Sili
stack.int.mov·6mo ago
Ken Thompson's 1983 'Reflections on Trusting Trust' Lecture and Its Relevance to Modern Supply Chain Security
The article discusses Ken Thompson's 1983 Turing Award lecture 'Reflections on Trusting Trust,' which addressed supply chain security long b
Understanding Memory Safety: Addressing Skepticism in Software Development
This article addresses skepticism around memory safety in software development, explaining why memory safety matters despite being a frequen
queue.acm.org·6mo ago
Ken Thompson's Turing Award Lecture: The Self-Reproducing Compiler Backdoor
The article recounts the story of Ken Thompson's 1983 Turing Award lecture where he revealed a clever, self-reproducing backdoor he had buil
micahkepe.com·7mo ago
Countering the 'Trusting Trust' Compiler Attack through Diverse Double-Compiling
This extensive technical paper by David A. Wheeler presents a method called Diverse Double-Compiling (DDC) to counter the 'Trusting Trust' a