3 ms·

I remember reading that the Linux kernel does not use Intel's hardware RNG alone for /dev/(u)random precisely because of concerns that Intel has backdoored the

by Cyph0n 10y ago

I remember reading that the Linux kernel does not use Intel's hardware RNG alone for /dev/(u)random precisely because of concerns that Intel has backdoored the RNG.

lisper 10y ago
Yes, that's true, and that is a legitimate concern. I personally would not trust Intel's RNG because it is implemented in a way that deliberately hides some of the underlying implementation in a way that would make it impossible to tell if it's backdoored. That is my original point: it is much harder to tell if hardware has a back door than software.
- Cyph0n 10y ago
  But does this not provide an example of an intentional backdoor in a hardware RNG? I'm actually going to be diving into the literature on hardware verification, with a focus on how to design IP that can be objectively verified by a third-party. If I find something good, I might even do my PhD on this topic.
  - nickpsecurity 10y ago
    This is the kind of tangential thinking tptacek apparently fell for in the BitBabbler discussion. While they were talking Intel RNG's, I was focusing on the fact that Intel advertises a chip-level backdoor w/ its own TCP/IP stack & MCU that listens even when CPU is shutdown. It's called AMT. That he knew about it but focused on risk of their TRNG when whole chip is backdoored is beyond my understanding. Here it is in case you weren't familiar with its specifics: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... Also, as in my recent reply to lisper, the hooks that make it work are probably in all the chips of any family containing at least one with that technology. That's to reduce mask and production costs. They might be able to remotely activate it but can't know cuz it's a black box. :)
  - lisper 10y ago
    > But does this not provide an example of an intentional backdoor in a hardware RNG? I don't know. No one knows outside of Intel. That's the whole point. In fact, it's possible that even inside Intel no one knows because a backdoor could have been surreptitiously inserted by a rogue engineer working for, say, the Chinese government, who has since left the company! I have no idea whether Intel's internal design review processes are thorough enough to prevent this. For someone who knew what they were doing and who was in a position to influence the design to insert a back door without being noticed would not be particularly hard. > I might even do my PhD on this topic. Good luck! Keep us posted.
    - Cyph0n 10y ago
      Ah yes, the insider threat is probably the toughest issue to deal with. At this point, I guess we can only hope that the RNG isn't backdoored. Thank you. I'll be sure to post something to HN once I've made some progress. That will take time though.
  - nickpsecurity 10y ago
    Just saw your line about HW verification. That was my last project. Mostly done with it. I came up with a few ways to do it but you always need or leak source. No way to do it with gates only so far. There's potential but I wouldnt trust it. The standard cells will take mutually-suspicious parties reviewing by eye with expertise in analog and RF. Email me and I'll send you some stuff. Summaries first then anywhere from a few to a pile of papers with specifics.
    - Cyph0n 10y ago
      Interesting! Thanks, that would be really helpful! I'll email you today. I was thinking of somehow combining a form of signature computation at each level (layout, schematic, RTL) with some low-overhead logic sprinkled throughout the circuit. The issue is mainly how and where to place the logic, but I'm hoping to get some ideas as I read through prior work.

by Cyph0n 10y ago

I remember reading that the Linux kernel does not use Intel's hardware RNG alone for /dev/(u)random precisely because of concerns that Intel has backdoored the RNG.

lisper 10y ago

Yes, that's true, and that is a legitimate concern. I personally would not trust Intel's RNG because it is implemented in a way that deliberately hides some of the underlying implementation in a way that would make it impossible to tell if it's backdoored. That is my original point: it is much harder to tell if hardware has a back door than software.

Cyph0n 10y ago
But does this not provide an example of an intentional backdoor in a hardware RNG? I'm actually going to be diving into the literature on hardware verification, with a focus on how to design IP that can be objectively verified by a third-party. If I find something good, I might even do my PhD on this topic.
- nickpsecurity 10y ago
  This is the kind of tangential thinking tptacek apparently fell for in the BitBabbler discussion. While they were talking Intel RNG's, I was focusing on the fact that Intel advertises a chip-level backdoor w/ its own TCP/IP stack & MCU that listens even when CPU is shutdown. It's called AMT. That he knew about it but focused on risk of their TRNG when whole chip is backdoored is beyond my understanding. Here it is in case you weren't familiar with its specifics: https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... Also, as in my recent reply to lisper, the hooks that make it work are probably in all the chips of any family containing at least one with that technology. That's to reduce mask and production costs. They might be able to remotely activate it but can't know cuz it's a black box. :)
- lisper 10y ago
  > But does this not provide an example of an intentional backdoor in a hardware RNG? I don't know. No one knows outside of Intel. That's the whole point. In fact, it's possible that even inside Intel no one knows because a backdoor could have been surreptitiously inserted by a rogue engineer working for, say, the Chinese government, who has since left the company! I have no idea whether Intel's internal design review processes are thorough enough to prevent this. For someone who knew what they were doing and who was in a position to influence the design to insert a back door without being noticed would not be particularly hard. > I might even do my PhD on this topic. Good luck! Keep us posted.
  - Cyph0n 10y ago
    Ah yes, the insider threat is probably the toughest issue to deal with. At this point, I guess we can only hope that the RNG isn't backdoored. Thank you. I'll be sure to post something to HN once I've made some progress. That will take time though.
- nickpsecurity 10y ago
  Just saw your line about HW verification. That was my last project. Mostly done with it. I came up with a few ways to do it but you always need or leak source. No way to do it with gates only so far. There's potential but I wouldnt trust it. The standard cells will take mutually-suspicious parties reviewing by eye with expertise in analog and RF. Email me and I'll send you some stuff. Summaries first then anywhere from a few to a pile of papers with specifics.
  - Cyph0n 10y ago
    Interesting! Thanks, that would be really helpful! I'll email you today. I was thinking of somehow combining a form of signature computation at each level (layout, schematic, RTL) with some low-overhead logic sprinkled throughout the circuit. The issue is mainly how and where to place the logic, but I'm hoping to get some ideas as I read through prior work.