@@ -118,7 +118,7 @@ independently for I and D keys.)
118
118
interfaces or as primitives in a compiler IR because they expose raw
119
119
pointers. Raw pointers require special attention in the language
120
120
implementation to avoid the accidental creation of exploitable code
121
- sequences; see the section on ` Attackable code sequences `_ .
121
+ sequences.
122
122
123
123
The following details are all implementation-defined:
124
124
@@ -172,9 +172,7 @@ Discriminators
172
172
A discriminator is arbitrary extra data which alters the signature calculated
173
173
for a pointer. When two pointers are signed differently --- either with
174
174
different keys or with different discriminators --- an attacker cannot simply
175
- replace one pointer with the other. For more information on why discriminators
176
- are important and how to use them effectively, see the section on `Substitution
177
- attacks `_.
175
+ replace one pointer with the other.
178
176
179
177
To use standard cryptographic terminology, a discriminator acts as a salt in
180
178
the signing of a pointer, and the key data acts as a pepper. That is, both the
@@ -244,8 +242,7 @@ signing schema breaks down even more simply:
244
242
It is important that the signing schema be independently derived at all signing
245
243
and authentication sites. Preferably, the schema should be hard-coded
246
244
everywhere it is needed, but at the very least, it must not be derived by
247
- inspecting information stored along with the pointer. See the section on
248
- `Attacks on pointer authentication `_ for more information.
245
+ inspecting information stored along with the pointer.
249
246
250
247
Language Features
251
248
-----------------
@@ -340,7 +337,7 @@ Produce a signed pointer for the given raw pointer without applying any
340
337
authentication or extra treatment. This operation is not required to have the
341
338
same behavior on a null pointer that the language implementation would.
342
339
343
- This is a treacherous operation that can easily result in ` signing oracles `_ .
340
+ This is a treacherous operation that can easily result in signing oracles.
344
341
Programs should use it seldom and carefully.
345
342
346
343
``ptrauth_auth_and_resign ``
@@ -361,8 +358,7 @@ a null pointer that the language implementation would.
361
358
The code sequence produced for this operation must not be directly attackable.
362
359
However, if the discriminator values are not constant integers, their
363
360
computations may still be attackable. In the future, Clang should be enhanced
364
- to guaranteed non-attackability if these expressions are
365
- :ref: `safely-derived<Safe derivation> `.
361
+ to guaranteed non-attackability if these expressions are safely-derived.
366
362
367
363
``ptrauth_auth_data ``
368
364
^^^^^^^^^^^^^^^^^^^^^
@@ -378,7 +374,7 @@ remove the signature.
378
374
as ``pointer ``. This operation is not required to have the same behavior on
379
375
a null pointer that the language implementation would.
380
376
381
- In the future when Clang makes ` safe derivation `_ guarantees, the result of
377
+ In the future when Clang makes safe derivation guarantees, the result of
382
378
this operation should be considered safely-derived.
383
379
384
380
``ptrauth_sign_generic_data ``
0 commit comments