Paper 2026/806 Original: eprint.iacr.org/2026/806 ↗
Spectre Without Dependent Load
Abstract
Transient execution attacks that disclose arbitrary memory commonly assume a multi-stage read-then-transmit gadget: a transient load to fetch secret data and a subsequent operation to leak that data into an observable side channel. We show that this assumption does not hold under electromagnetic (EM) observations, by verifying that a single transient load already produces value-dependent EM leakage without any explicit follow-up transmission instruction or relying on prefetching. Our results expand the set of exploitable gadgets and show that even simple processors like the Cortex-A53 are vulnerable.
Metadata
- Available format(s)
PDF- Category
- Attacks and cryptanalysis
- Publication info
- Preprint.
- History
- 2026-04-23: last updated
- 2026-04-23: published
- Short URL
- https://ia.cr/2026/806
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2026/806,
author = {Can Aknesil and Andreas Lindner and Roberto Guanciale and Hamed Nemati},
title = {Spectre Without Dependent Load},
howpublished = {Cryptology {ePrint} Archive, Paper 2026/806},
year = {2026},
url = {https://eprint.iacr.org/2026/806}
}