{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T19:49:07Z","timestamp":1774554547384,"version":"3.50.1"},"reference-count":29,"publisher":"Association for Computing Machinery (ACM)","issue":"1","funder":[{"name":"Deutsche Forschungsgemeinschaft &#x28;DFG&#x29;","award":["390781972"],"award-info":[{"award-number":["390781972"]}]},{"name":"European Union&rsquo;s Horizon 2020 research and innovation program","award":["101070627"],"award-info":[{"award-number":["101070627"]}]},{"name":"European Union&rsquo;s Horizon 2020 research and innovation program","award":["101097122"],"award-info":[{"award-number":["101097122"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Meas. Anal. Comput. Syst."],"published-print":{"date-parts":[[2026,3,26]]},"abstract":"<jats:p>An extensive line of work on modern computing architectures has shown that the execution time of instructions can (i) depend on the operand of the instruction or (ii) be influenced by system optimizations, e.g., branch prediction and speculative execution paradigms.<\/jats:p>\n                  <jats:p>In this paper, we systematically measure and analyze timing variabilities in conditional jump instructions that can be macro-fused with a preceding instruction, depending on their placement within the binary. Our measurements indicate that these timing variations stem from the \u00b5op cache placement and the jump's offset in the L1 instruction cache of modern processors. We demonstrate that this behavior is consistent across multiple microarchitectures, including Skylake, Coffee Lake, and Kaby Lake, as well as various real-world implementations. We confirm the prevalence of this variability through extensive experiments on a large-scale set of popular binaries, including libraries from Ubuntu 24.04, Windows 10 Pro, and several open-source cryptographic libraries. We also show that one can easily avoid this timing variability by ensuring that macro-fusible instructions are 32-byte aligned - an approach initially suggested in 2019 by Intel in an overlooked short report. We quantify the performance impact of this approach across the cryptographic libraries, showing a speedup of 2.15% on average (and up to 10.54%) when avoiding the timing variability. As a by-product, we show that this variability can be exploited as a covert channel, achieving a maximum throughput of 16.14 Mbps.<\/jats:p>","DOI":"10.1145\/3788099","type":"journal-article","created":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T18:49:47Z","timestamp":1774550987000},"page":"1-23","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["On Abnormal Execution Timing of Conditional Jump Instructions"],"prefix":"10.1145","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6092-7866","authenticated-orcid":false,"given":"Annika","family":"Wilde","sequence":"first","affiliation":[{"name":"Ruhr University Bochum, Bochum, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7671-0242","authenticated-orcid":false,"given":"Samira","family":"Briongos","sequence":"additional","affiliation":[{"name":"NEC Laboratories Europe, Heidelberg, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8215-5457","authenticated-orcid":false,"given":"Claudio","family":"Soriente","sequence":"additional","affiliation":[{"name":"GMV Spain, Madrid, Spain"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2828-4071","authenticated-orcid":false,"given":"Ghassan","family":"Karame","sequence":"additional","affiliation":[{"name":"Ruhr University Bochum, Bochum, Germany"}]}],"member":"320","published-online":{"date-parts":[[2026,3,26]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1007\/11967668_15"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00066"},{"key":"e_1_2_1_3_1","first-page":"53","volume-title":"Verifying Constant-Time Implementations. In 25th USENIX Security Symposium, USENIX Security 16","author":"Almeida Jos\u00e9 Bacelar","year":"2016","unstructured":"Jos\u00e9 Bacelar Almeida, Manuel Barbosa, Gilles Barthe, Fran\u00e7ois Dupressoir, and Michael Emmi. 2016. Verifying Constant-Time Implementations. In 25th USENIX Security Symposium, USENIX Security 16, Austin, TX, USA, August 10-12, 2016, Thorsten Holz and Stefan Savage (Eds.). USENIX Association, 53-70. https:\/\/www.usenix.org\/conference\/usenixsecurity16\/technical-sessions\/presentation\/almeida DBLP:conf\/uss\/AlmeidaBBDE16."},{"key":"e_1_2_1_4_1","unstructured":"Amazon Web Services (AWS). 2025. s2n-tls Release v1.5.18. https:\/\/github.com\/aws\/s2n-tls\/releases\/tag\/v1.5.18. Accessed: 2025-12-15."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.44"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363194"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/EUROSP51992.2021.00051"},{"key":"e_1_2_1_8_1","volume-title":"27th USENIX Security Symposium, USENIX Security 2018","author":"Bulck Jo Van","year":"2018","unstructured":"Jo Van Bulck, Marina Minkin, Ofir Weisse, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Thomas F. Wenisch, Yuval Yarom, and Raoul Strackx. 2018. Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution. In 27th USENIX Security Symposium, USENIX Security 2018, Baltimore, MD, USA, August 15-17, 2018, William Enck and Adrienne Porter Felt (Eds.). USENIX Association, 991-1008. https:\/\/www.usenix.org\/conference\/usenixsecurity18\/presentation\/bulck DBLP:conf\/uss\/BulckMWGKPSWYS18."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363219"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA53966.2022.00013"},{"key":"e_1_2_1_11_1","volume-title":"AMD, and VIA CPUs. https:\/\/www.agner.org\/optimize\/microarchitecture.pdf. [Online","author":"Fog Agner","year":"2024","unstructured":"Agner Fog. 2024. The microarchitecture of Intel, AMD, and VIA CPUs. https:\/\/www.agner.org\/optimize\/microarchitecture.pdf. [Online; accessed 2024-08-28]."},{"key":"e_1_2_1_12_1","volume-title":"Free Software Foundation","author":"Inc.","year":"2025","unstructured":"Inc. Free Software Foundation. 2025a. as(1) - Linux man page. https:\/\/linux.die.net\/man\/1\/as Online; accessed 09.03.2025."},{"key":"e_1_2_1_13_1","volume-title":"Free Software Foundation","author":"Inc.","year":"2025","unstructured":"Inc. Free Software Foundation. 2025b. GCC Option Summary. https:\/\/gcc.gnu.org\/onlinedocs\/gcc\/Option-Summary.html Online; accessed 9 March 2025."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14423-3_13"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2015.7056069"},{"key":"e_1_2_1_16_1","unstructured":"Intel. 2019. Mitigations for Jump Conditional Code Erratum. https:\/\/www.intel.com\/content\/www\/us\/en\/content-details\/841076\/intel-mitigations-for-jump-conditional-code-erratum.html Revision 1.0."},{"key":"e_1_2_1_17_1","unstructured":"Intel. 2024. Optimizing Earlier Generations of Intel 64 and IA-32 Processor Architectures Throughput and Latency. https:\/\/www.intel.com\/content\/www\/us\/en\/content-details\/821614\/optimizing-earlier-generations-of-intel-64-and-ia-32-processor-architectures-throughput-and-latency.html. Version 050."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.18420\/SW2024_47"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3545948.3545972"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3466752.3480079"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00002"},{"key":"e_1_2_1_22_1","volume-title":"broken hyper-threading. https:\/\/lwn.net\/Articles\/726496\/. [Online","author":"Kaby Intel","year":"2025","unstructured":"LWN.net. 2017. Intel Skylake\/Kaby Lake processors: broken hyper-threading. https:\/\/lwn.net\/Articles\/726496\/. [Online; accessed 2025-07-22]."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484816"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA52012.2021.00036"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1155\/2023\/8031859"},{"key":"e_1_2_1_26_1","unstructured":"Annika Wilde Samira Briongos Claudio Soriente and Ghassan Karame. 2026. Artifact On Abnormal Execution Timing of Conditional Jump Instructions: Repository on GitHub. https:\/\/github.com\/RUB-InfSec\/abnormal_conditional_jump_timing"},{"key":"e_1_2_1_27_1","unstructured":"wolfSSL. 2022. wolfSSL 2022 Annual Report. https:\/\/www.wolfssl.com\/wolfssl-2022-annual-report\/. Accessed: 2025-12-15."},{"key":"e_1_2_1_28_1","unstructured":"wolfSSL. 2025. WolfSSL Commit 151b9f0. https:\/\/github.com\/wolfSSL\/wolfssl\/commit\/151b9f0e74f4e635e9360ca3e61c502de49b9bfc. Accessed: 2025-12-15."},{"key":"e_1_2_1_29_1","first-page":"719","volume-title":"Proceedings of the 23rd USENIX Security Symposium","author":"Yarom Yuval","year":"2014","unstructured":"Yuval Yarom and Katrina Falkner. 2014. FLUSHRELOAD: A High Resolution, Low Noise, L3 Cache Side-Channel Attack. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 20-22, 2014, Kevin Fu and Jaeyeon Jung (Eds.). USENIX Association, 719-732. https:\/\/www.usenix.org\/conference\/usenixsecurity14\/technical-sessions\/presentation\/yarom DBLP:conf\/uss\/YaromF14."}],"container-title":["Proceedings of the ACM on Measurement and Analysis of Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3788099","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T18:50:47Z","timestamp":1774551047000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3788099"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,26]]},"references-count":29,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2026,3,26]]}},"alternative-id":["10.1145\/3788099"],"URL":"https:\/\/doi.org\/10.1145\/3788099","relation":{},"ISSN":["2476-1249"],"issn-type":[{"value":"2476-1249","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,26]]},"assertion":[{"value":"2026-03-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}