CHERI: A Hybrid Capability-System Architecture for Scalable Software Compartmentalization. Robert N. M. Watson and colleagues presented this work at the IEEE Symposium on Security and Privacy in 2015. CHERI is a hybrid capability design that lets conventional software coexist with capability-aware components. This episode explains how that design bounds memory authority, how the researchers evaluated software compartments, and where the evidence stops.

CHERI uses tagged 256-bit capabilities that carry bounds and permissions. Authority is monotonic, meaning software can reduce it but cannot increase it. The hybrid design adds these capabilities while preserving conventional architecture and software compatibility. Object-capability support combines sealing and object types with local capabilities and protected call-and-return operations.

The practical question is whether bounded hardware authority and protected calls can divide conventional software into useful in-process compartments. If one component is compromised, the intended boundary should restrict which memory and services it can reach. The researchers also needed to examine compatibility and crossing costs: an isolation mechanism has limited operational value if adopting it requires replacing the software stack or if protected calls are as expensive as heavier process-based isolation.

The design combines capability bounds and permissions with sealing and protected call-and-return operations. Together, these mechanisms let components cross explicit boundaries without receiving unrestricted access to the surrounding process. For the security review, the researchers adapted tcpdump and examined 29 historical vulnerabilities against the resulting compartments. Performance testing measured protected-call and process-transition costs, then tracked processing cost as more sandboxes were added. Integration testing evaluated a compartment around zlib and recorded the compiler and operating-system changes.

In the tcpdump review, the combined compartments addressed nearly all of the 29 historical vulnerabilities examined. Another experiment measured per-sandbox processing cost as the prototype scaled to 128 sandboxes. The results support a limited conclusion: the compartments covered most of that historical vulnerability set, and the prototype operated at the evaluated scale. They do not establish protection against every future flaw or workload.

The study measured cycle counts for function, libcheri, and process transitions. This quantifies transition costs in the evaluated implementation, but it does not establish a performance ordering or provide a universal performance guarantee.

Base CHERI does not natively provide temporal safety. In plain terms, restricting where a capability can point does not prove that the referenced memory remains valid after its intended lifetime ends. The evaluation is also bounded by its threat model and the code that must remain trusted. Side channels impose another limit. The evidence supports bounded, monotonic authority but does not establish complete memory safety or side-channel protection.

Security architects and platform engineers can consider CHERI’s hybrid design when compatibility with conventional architecture and software matters. Its object-capability support uses several mechanisms together. These include sealing and object types, along with local capabilities and protected call-and-return operations. The tcpdump work counted the adaptation footprint and wrapped functions, but those counts alone do not establish how extensive another adaptation would be. Base CHERI still lacks native temporal safety. Trusted code, the threat model, and side channels require separate consideration.

Watson and colleagues combined tagged capabilities carrying bounded, monotonic authority with protected call-and-return operations while preserving conventional architecture and software compatibility. They evaluated the design through tcpdump compartments, transition measurements, and software-stack integration. In tcpdump, the combined compartments addressed nearly all of the historical vulnerabilities examined. The transition measurements quantified costs in the evaluated implementation. The evidence does not establish native temporal safety or side-channel protection. Effectiveness outside the evaluated applications and prototype conditions remains uncertain, including under different threat models and trusted-code assumptions.