A Genetic Algorithm for a Spectre Attack Agnostic to Branch Predictors

Dorian Bourgeoisat (1, 2) , Laurent Sauvage (1, 2)

1 COMELEC - Département Communications & Electronique
2 SSH - Secure and Safe Hardware

This paper explores the possibility of using a genetic algorithm to launch a Spectre attack on different branch predictors with the same binary. We focus on RISC-V architectures, specifically Sonic-BOOM, as they are the most likely to have a wide variety of branch predictors while sharing the same ISA. We show that our genetic algorithm is able to find a training and attack sequence to mount a Spectre Bounds Check Bypass attack on multiple branch predictors.

Domains: Physics [physics]

Dorian Bourgeoisat, Laurent Sauvage. A Genetic Algorithm for a Spectre Attack Agnostic to Branch Predictors. Seventh Workshop on Computer Architecture Research with RISC-V (CARRV 2023), Jun 2023, Orlanda (Florida), United States. ⟨hal-04210397⟩