4

is the 64 bit or the 32 bit installer better? (not counting that if i have x>4 GByte RAM) - so i mean like is there any ASLR in OpenBSD?

https://secure.wikimedia.org/wikipedia/en/wiki/Address_space_layout_randomization
So that 64bit would be advised to use?

1
  • Can you please focus your question on security topics? Is your question specifically wrt ASLR, or is it something else?
    – AviD
    Mar 26, 2011 at 21:04

2 Answers 2

7

On x86 processors, 64-bit mode offers significant performance benefits for some cryptographic operations, in particular asymmetric encryption and signatures; this is partly due to the bigger registers (it helps with big-integer arithmetics, and algorithms which rely on 64-bit operations) and due to the higher number of registers (that's a quirk of x86: 7 usable registers in 32-bit mode, 15 in 64-bit mode). It also gives a boost to floating-point, there again for historical reasons: a processor which knows 64-bit mode also knows SSE2, which is a set of opcodes which are more efficient for floating-point operations than the older 8087 FPU opcodes that are used in 32-bit mode.

Hence, on the x86 processors, 64-bit mode is good for performance (this performance boost more than makes up for the slight memory consumption increase due to the bigger pointers). The same would not apply on other 32/64-bit processors, e.g. PowerPC, where 32-bit mode is recommended for applicative code, except code which needs a very large address space.

OpenBSD implements ASLR. Note that ASLR is a damage-containment feature: it makes it more difficult to turn a buffer overflow into a remote shell exploit. However, the buffer overflow is still there; ASLR just means that most of the time, the attacker will "only" be able to crash the application. The benefit is, in my view, quite marginal.

5
  • You're saying 64-bit mode offers benefits on x86 processors. However, I've always recognized "x86" to refer to a 32-bit hardware architecture, while "x64" denotes a 64-bit system. And, far as I'm aware, 64-bit code cannot natively be run on 32-bit systems. Am I mistaken?
    – Iszi
    May 28, 2011 at 19:30
  • @Iszi In common parlance you're right, though he's likely using it to refer to the genero-x86 architecture, where x86_64 is a 64-bit implementation. As opposed to PPC, SPARC, etc.
    – Scott Pack
    May 28, 2011 at 20:34
  • @Iszi: "x64" is actually a Windows word. In the Linux world, it is known as "amd64" or "x86_64" (the 32-bit counterpart being "i386"). There are yet other conventions. The one I am using is that "x86" designates the line of processors (from the 8086 to the Core i3/i5/i7), and 32-bit or 64-bit modes are called "32-bit mode" and "64-bit mode", respectively (and unimaginatively). The 64-bit mode was known in the first AMD specifications as "long mode". May 28, 2011 at 21:28
  • Seems there's a terminology lesson to be had every day.
    – Iszi
    May 29, 2011 at 3:45
  • ASLR in 32-bit processors means you may run out of address space really easily. No need to have a buffer overflow in order to crash your software.
    – user296
    Nov 6, 2011 at 2:09
5

Security-wise, one notable difference is that W^X can't work as well on i386 (32-bit) as it can on amd64 (64-bit). Some other arch have other benefits (for example sparc64 has StackGhost which adds more protection).

Apart from this, amd64 mode has more CPU registers, i386 mode has smaller addresses/data structures so you might make better use of the CPU's cache, so for a performance-sensitive application it's better to benchmark both modes.

1
  • +1 for the trying it out. Definitely makes sense as each case may have differing requirements.
    – Rory Alsop
    May 28, 2011 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .