Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

is the 64 bit or the 32 bit installer better? (not counting that if i have x>4 GByte RAM) - so i mean like is there any ASLR in OpenBSD?

https://secure.wikimedia.org/wikipedia/en/wiki/Address_space_layout_randomization
So that 64bit would be advised to use?

share|improve this question
    
Can you please focus your question on security topics? Is your question specifically wrt ASLR, or is it something else? –  AviD Mar 26 '11 at 21:04

2 Answers 2

up vote 6 down vote accepted

On x86 processors, 64-bit mode offers significant performance benefits for some cryptographic operations, in particular asymmetric encryption and signatures; this is partly due to the bigger registers (it helps with big-integer arithmetics, and algorithms which rely on 64-bit operations) and due to the higher number of registers (that's a quirk of x86: 7 usable registers in 32-bit mode, 15 in 64-bit mode). It also gives a boost to floating-point, there again for historical reasons: a processor which knows 64-bit mode also knows SSE2, which is a set of opcodes which are more efficient for floating-point operations than the older 8087 FPU opcodes that are used in 32-bit mode.

Hence, on the x86 processors, 64-bit mode is good for performance (this performance boost more than makes up for the slight memory consumption increase due to the bigger pointers). The same would not apply on other 32/64-bit processors, e.g. PowerPC, where 32-bit mode is recommended for applicative code, except code which needs a very large address space.

OpenBSD implements ASLR. Note that ASLR is a damage-containment feature: it makes it more difficult to turn a buffer overflow into a remote shell exploit. However, the buffer overflow is still there; ASLR just means that most of the time, the attacker will "only" be able to crash the application. The benefit is, in my view, quite marginal.

share|improve this answer
    
You're saying 64-bit mode offers benefits on x86 processors. However, I've always recognized "x86" to refer to a 32-bit hardware architecture, while "x64" denotes a 64-bit system. And, far as I'm aware, 64-bit code cannot natively be run on 32-bit systems. Am I mistaken? –  Iszi May 28 '11 at 19:30
    
@Iszi In common parlance you're right, though he's likely using it to refer to the genero-x86 architecture, where x86_64 is a 64-bit implementation. As opposed to PPC, SPARC, etc. –  Scott Pack May 28 '11 at 20:34
    
@Iszi: "x64" is actually a Windows word. In the Linux world, it is known as "amd64" or "x86_64" (the 32-bit counterpart being "i386"). There are yet other conventions. The one I am using is that "x86" designates the line of processors (from the 8086 to the Core i3/i5/i7), and 32-bit or 64-bit modes are called "32-bit mode" and "64-bit mode", respectively (and unimaginatively). The 64-bit mode was known in the first AMD specifications as "long mode". –  Thomas Pornin May 28 '11 at 21:28
    
Seems there's a terminology lesson to be had every day. –  Iszi May 29 '11 at 3:45
    
ASLR in 32-bit processors means you may run out of address space really easily. No need to have a buffer overflow in order to crash your software. –  jbcreix Nov 6 '11 at 2:09

Security-wise, one notable difference is that W^X can't work as well on i386 (32-bit) as it can on amd64 (64-bit). Some other arch have other benefits (for example sparc64 has StackGhost which adds more protection).

Apart from this, amd64 mode has more CPU registers, i386 mode has smaller addresses/data structures so you might make better use of the CPU's cache, so for a performance-sensitive application it's better to benchmark both modes.

share|improve this answer
    
+1 for the trying it out. Definitely makes sense as each case may have differing requirements. –  Rory Alsop May 28 '11 at 20:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.