bytecodealliance / bytecodealliance/wasmtime
wasi-common: high resolution timers can be a security or fingerprinting risk in some contexts
- Dominant language
- Rust
- Stars
- 18.6k
- Forks
- 1.8k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 126
Description
As we know, in the browser space there are various concerns around speculative execution attacks (Spectre etc) that are mitigated in part by reducing the precision of timers available to untrusted code.
Presently, `wasi-common`'s timer APIs provide resolution as high as the underlying OS provides.
I propose implementing a configurable timing-precision-reduced mode to the `wasi-common` crate. The precision available will configured as part of the `WasiCtxBuilder`. Full resolution will still be available to users who want it, but one open question is whether the default should be full resolution or some reduced value. Different browsers have set different default precision levels - FF and Edge 20us, Chrome 100us, Safari 1ms according to https://github.com/w3c/hr-time/issues/56.
The following well-commented implementation in Firefox looks like a good reference on how clamping and jitter should work: https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/nsRFPService.cpp#446
Contributor guide
Assessment
This issue has not been assessed yet.