Not quite a piece of CHERI-cake: Are new digital security by design architectures usable?

• URL: http://arxiv.org/abs/2506.23682v1
• Date: Mon, 30 Jun 2025 10:04:14 GMT
• Title: Not quite a piece of CHERI-cake: Are new digital security by design architectures usable?
• Abstract summary: CHERI lets you program without fear of buffer overflows or other memory safety errors.<n>We find that developers struggle with CHERI's display of warnings and errors and a lack of diverse documentation.
• Score: 0.8594140167290099
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: A digital security-by-design computer architecture, like CHERI, lets you program without fear of buffer overflows or other memory safety errors, but CHERI also rewrites some of the assumptions about how C works and how fundamental types (such as pointers) are implemented in hardware. We conducted a usability study to examine how developers react to the changes required by CHERI when porting software to run on it. We find that developers struggle with CHERI's display of warnings and errors and a lack of diverse documentation.

Related papers

• Finding a Crab in the C: Assured Translation via Comparative Symbolic Execution [0.0]
  cozy is a comparative binary analysis tool that analyzes a binary compiled from "unsafe" source code and a binary compiled from a translation of the source code to a memory safe language.<n> cozy walks the developer through differences in the behavior of the two binaries, presenting each difference and asking the user to assess whether the difference is intentional (good) or erroneous.<n> cozy has applications to automated translation, bug correction, code reviews, operation authorization, and automatic translation.
  arXiv  Detail & Related papers  (2026-05-12T20:33:33Z)
• Sockeye: a language for analyzing hardware documentation [0.2142042364864257]
  We introduce a domain-specific language to describe hardware semantics, assumptions about software behavior, and desired security properties.<n>We then create machine-specified specifications for a diverse set of eight System-on-Chips from their reference manuals.
  arXiv  Detail & Related papers  (2025-10-31T14:04:01Z)
• Security Enclave Architecture for Heterogeneous Security Primitives for Supply-Chain Attacks [7.9837065464150685]
  This paper explores the range of obstacles encountered when building a unified security architecture capable of addressing multiple attack vectors.<n>We present a thorough evaluation of its impact on silicon area and power consumption across various ASIC technologies.
  arXiv  Detail & Related papers  (2025-07-15T04:28:02Z)
• Biting the CHERI bullet: Blockers, Enablers and Security Implications of CHERI in Defence [0.8158530638728498]
  We present results from a 12 month evaluation of one such secure hardware solution, CHERI.<n>15 teams from industry and academia ported software relevant to Defence to Arm's experimental Morello board.<n>We identified six types of blocker inhibiting adoption: dependencies, a knowledge premium, missing utilities, performance, platform instability, and technical debt.
  arXiv  Detail & Related papers  (2025-04-24T19:44:12Z)
• CRUST-Bench: A Comprehensive Benchmark for C-to-safe-Rust Transpilation [63.23120252801889]
  CRUST-Bench is a dataset of 100 C repositories, each paired with manually-written interfaces in safe Rust as well as test cases.<n>We evaluate state-of-the-art large language models (LLMs) on this task and find that safe and idiomatic Rust generation is still a challenging problem.<n>The best performing model, OpenAI o1, is able to solve only 15 tasks in a single-shot setting.
  arXiv  Detail & Related papers  (2025-04-21T17:33:33Z)
• Breaking Bad: How Compilers Break Constant-Time~Implementations [12.486727810118497]
  We investigate how compilers break protections introduced by defensive programming techniques. We run a large-scale experiment to see if such compiler-induced issues manifest in state-of-the-art cryptographic libraries. Our study reveals that several compiler-induced secret-dependent operations occur within some of the most highly regarded cryptographic libraries.
  arXiv  Detail & Related papers  (2024-10-17T12:34:02Z)
• SoK: A Security Architect's View of Printed Circuit Board Attacks [0.5461938536945721]
  Many recent papers have proposed novel electrical measurements or physical inspection technologies for defending printed circuit boards (PCBs) and printed circuit board assemblies (PCBAs) against tampering. As motivation, these papers frequently cite Bloomberg News' "The Big Hack", video game modchips, and "interdiction attacks" on IT equipment. First, implementation errors and security architecture are rarely discussed in recent PCBA security research. Second, if we assume that novel countermeasures and validation methodologies are tailored to these oft-cited attacks, then significant recent work has focused on attacks that can already be mitigated.
  arXiv  Detail & Related papers  (2024-10-13T20:29:42Z)
• Designing and Implementing a Generator Framework for a SIMD Abstraction Library [53.84310825081338]
  We present TSLGen, a novel end-to-end framework for generating an SIMD abstraction library. We show that our framework is comparable to existing libraries, and we achieve the same performance results.
  arXiv  Detail & Related papers  (2024-07-26T13:25:38Z)
• Mon CHÉRI: Mitigating Uninitialized Memory Access with Conditional Capabilities [1.9042151977387252]
  Up to 10% of memory-safety vulnerabilities in languages like C and C++ stem from und variables.<n>This work addresses the prevalence and lack of adequate software mitigations for und memory issues.<n>We extend the CHERI capability model to include "conditional capabilities", enabling memory-access policies based on prior operations.
  arXiv  Detail & Related papers  (2024-07-11T16:51:36Z)
• On the Security Blind Spots of Software Composition Analysis [46.1389163921338]
  We present a novel approach to detect vulnerable clones in the Maven repository. We retrieve over 53k potential vulnerable clones from Maven Central. We detect 727 confirmed vulnerable clones and synthesize a testable proof-of-vulnerability project for each of those.
  arXiv  Detail & Related papers  (2023-06-08T20:14:46Z)
• The Dark Side of AutoML: Towards Architectural Backdoor Search [49.16544351888333]
  EVAS is a new attack that leverages NAS to find neural architectures with inherent backdoors and exploits such vulnerability using input-aware triggers. EVAS features high evasiveness, transferability, and robustness, thereby expanding the adversary's design spectrum. This work raises concerns about the current practice of NAS and points to potential directions to develop effective countermeasures.
  arXiv  Detail & Related papers  (2022-10-21T18:13:23Z)
• The Devil is in the Details: On Models and Training Regimes for Few-Shot Intent Classification [81.60168035505039]
  Few-shot Classification (FSIC) is one of the key challenges in modular task-oriented dialog systems. We show that cross-encoder architecture and episodic meta-learning consistently yields the best FSIC performance. Our findings pave the way for conducting state-of-the-art research in FSIC.
  arXiv  Detail & Related papers  (2022-10-12T17:37:54Z)
• On the interplay of adversarial robustness and architecture components: patches, convolution and attention [65.20660287833537]
  We study the effect of adversarial training on the interpretability of the learnt features and robustness to unseen threat models. An ablation from ResNet to ConvNeXt reveals key architectural changes leading to almost $10%$ higher $ell_infty$-robustness.
  arXiv  Detail & Related papers  (2022-09-14T22:02:32Z)
• Dos and Don'ts of Machine Learning in Computer Security [74.1816306998445]
  Despite great potential, machine learning in security is prone to subtle pitfalls that undermine its performance. We identify common pitfalls in the design, implementation, and evaluation of learning-based security systems. We propose actionable recommendations to support researchers in avoiding or mitigating the pitfalls where possible.
  arXiv  Detail & Related papers  (2020-10-19T13:09:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.