Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Apart from stronger ALSR entropy...

Is a system using amd64 any safer than 686-pae?

What are the advantages, if any?

share|improve this question

1 Answer

up vote 3 down vote accepted

In general, yes, using 64-bit architectures is a bit safer.

ASLR (Address Space Layout Randomization) is a lot more effective on 64-bit architectures. On 32-bit architectures, ASLR is not very effective. On 32-bit architectures, it's only possible to introduce a half a dozen or a dozen or so bits of randomness into the address space layout. This means that an attacker can defeat ASLR by simply trying many times (a few hundred or a few thousand times).

ASLR makes it harder for an attacker to exploit buffer overrun vulnerabilities, so this difference between 32-bit and 64-bit architectures has some relevance to system security.

Apart from its effects on ASLR, I'm not aware of any security benefits of a 64-bit architecture over a 32-bit architecture.

share|improve this answer
Depending on OS in use, 64bit editions may also be more secure than their equivalent 32-bit versions. – AviD♦ Oct 22 '12 at 18:39
1  
Note that in 64-bit mode, the address space is usually not as large as 64 bits, but only 48 bits in current amd64-able CPU; and the OS can limit that further (44 bits in Windows). This is not specific to x86; if I remember correctly, 64-bit Alpha was also limited to 45 bits of actual address space. – Thomas Pornin Oct 23 '12 at 0:37
1  
@ThomasPornin If I remember correctly, this is to do with the way that page tables are handled. Each section of the physical 48-bit address corresponds to various sections of the page table, but making it handle the full 64-bit address space would cause a large amount of memory to be wasted on page metadata entries that simply won't be used on systems with 256TB of RAM or less. – Polynomial Oct 23 '12 at 7:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.