https://algoatson.github.io/series/microarchitectural-attacks/ A bounds check the CPU hasn't finished evaluating doesn't stop it from speculatively running the code behind it. Spectre v1 trains the branch predictor to run an out-of-bounds read, encodes the secret into the cache, and reads it back with FLUSH+RELOAD after the architecture rolls everything else away. en Tue, 16 Jun 2026 02:47:52 +0000 https://algoatson.github.io/p/flush-reload-cache-side-channel/ https://algoatson.github.io/p/flush-reload-cache-side-channel/ Sun, 08 Mar 2026 00:00:00 +0000 side-channelresearchcrypto You don't always need to read a victim's memory to learn its secrets — you can watch which lines it pulls into cache. Flush a shared line, let the victim run, time how long it takes to reload, and the access latency tells you whether the victim touched it. Repeat, and a secret-dependent access pattern falls out. https://algoatson.github.io/p/prime-probe-eviction-sets/ https://algoatson.github.io/p/prime-probe-eviction-sets/ Tue, 10 Mar 2026 00:00:00 +0000 side-channelresearch FLUSH+RELOAD needs memory shared with the victim. Prime+Probe drops that requirement: fill a cache set with your own lines, let the victim run, and time how many of yours got evicted. You lose address-level resolution and gain the ability to spy across processes and VMs that share nothing but silicon. https://algoatson.github.io/p/spectre-v1-bounds-check-bypass/ https://algoatson.github.io/p/spectre-v1-bounds-check-bypass/ Thu, 12 Mar 2026 00:00:00 +0000 side-channelresearch A bounds check the CPU hasn't finished evaluating doesn't stop it from speculatively running the code behind it. Spectre v1 trains the branch predictor to run an out-of-bounds read, encodes the secret into the cache, and reads it back with FLUSH+RELOAD after the architecture rolls everything else away.