Paper 2026/806
Spectre Without Dependent Load
, Royal Institute of Technology (KTH), Uppsala University, Royal Institute of Technology (KTH), Royal Institute of Technology (KTH)Abstract
Transient execution attacks that disclose arbitrary memory commonly assume a multi-stage read-then-transmit gadget: a transient load to fetch secret data and a subsequent operation to leak that data into an observable side channel. We show that this assumption does not hold under electromagnetic (EM) observations, by verifying that a single transient load already produces value-dependent EM leakage without any explicit follow-up transmission instruction or relying on prefetching. Our results expand the set of exploitable gadgets and show that even simple processors like the Cortex-A53 are vulnerable.
Metadata
- Available format(s)
-
PDF
- Category
- Attacks and cryptanalysis
- Publication info
- Preprint.
- Keywords
- microarchitectural securityelectromagnetic side-channel attacksspeculative execution
- Contact author(s)
-
aknesil @ kth se
andreas lindner @ angstrom uu se
robertog @ kth se
hnnemati @ kth se - History
- 2026-04-27: approved
- 2026-04-23: received
- See all versions
- Short URL
- https://ia.cr/2026/806
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2026/806,
author = {Can Aknesil and Andreas Lindner and Roberto Guanciale and Hamed Nemati},
title = {Spectre Without Dependent Load},
howpublished = {Cryptology {ePrint} Archive, Paper 2026/806},
year = {2026},
url = {https://eprint.iacr.org/2026/806}
}
