3 ms·

The logical end-state of this train of thinking is tamper-resistant key generation and storage, with fully published sources and audited assembly line productio

The logical end-state of this train of thinking is tamper-resistant key generation and storage, with fully published sources and audited assembly line production. Except then they need to ensure that all the equipment on their line was produced by trusted suppliers with the same level of disclosure. Ditto all software which touches anything in the manufacturing process. It's turtles all the way down, see also "on trusting trust".

nickpsecurity 10y ago
Or just do it with open code & hardware on an ASIC whose process node is verifiable by eye with a microscope against a reference image after samples of it are decapped. Either by the owner or numerous third parties. You make it sound much harder than it is unless they're using unverifiable technology. In that case, it might be pretty hard. ;)
- Godel_unicode 10y ago
  That's ridiculous. People can't reliably produce good implementations of crypto software, and you suggest they design and verify ASICs? My point was that security is about understanding and accepting, not foolishly trying to eliminate, risk. Just a few of the mountains which need climbing: First, you'd need a (actually) random sampling not just one (keep in mind any ASIC you test is likely a write-off due to tamper-resistance). You'd also need a high assurance supply chain to ensure your verification isn't premature (as well as sufficient levels of tamper resistance/evidence). You'd further need to verify the software around this hypothetical ASIC is free of bugs. You're restricting yourself to software which can be performant on older slower process nodes. You (almost certainly not an ASIC company) need to have an in-house ASIC shop, or you need to vet an external one (sounds cheap and easy for the average business). In fact, you need vetting of your internal staff at all stages of this process. You are making this seem _much_ easier than it is. There's a reason this product, which there is definitely a market for, doesn't exist (and that reason is much more mundane than the cryptolluminati not wanting it to "get out"). Consider that Google did something like what you're suggesting. It took them years (and they're Google), what chance does the average person/SMB have?
  - hvidgaard 10y ago
    I suppose you could use an fpga, but you still need to audit the assembly line. It's not simple, and you will place trust somewhere.
    - hwh 10y ago
      So, more turtles waiting down there.... In the end, it is the attempt to create a positive proof in a system that is not a defined formal system (real world vs pure mathematics). Impossible - as you say, you need to place your trust somewhere. Even if it's your own abilities. But that trust can always turn out to be not justified.
      - nickpsecurity 10y ago
        You need to make a simple interpreter or processor that's verified by eye, brute force, or mathematically. An old example was FM9001 with newer ones being VAMP (open?) and AAMP7G (proprietary). You do that on a node you can verify by eye. You verify a random sample of the pile you ordered by eye. You use it with cheapest, simplest, oldest parts for input and display that you ordered in obfuscated way so they don't think source of order was important. Then, you have hardware you can trust to do the rest of the calculations for trustworthy hardware or software that's much better. Including image recognition software to semi-automate your job of spotting things that don't below in images of chips. ;)
    - nickpsecurity 10y ago
      Use my same trick but with FPGA's. Those on older nodes barely have any logic gates, though. Another trick for the wealthy is using the latest node that's so cutting-edge they can barely get stuff to work at all. Hard to do some subversion of a black box if state-of-the-art verification barely made that black box functional to begin with.
  - nickpsecurity 10y ago
    "That's ridiculous. People can't reliably produce good implementations of crypto software, and you suggest they design and verify ASICs? " You suggested that they verify or perfect every person or thing in the entire supply chain. That was ridiculous. I suggested they or trusted, third parties simply verify an ASIC. That's doable. Matter of fact, people already tear down and image ASIC's on older nodes for fun. A number of companies and labs tear down modern ASIC's to reverse engineer them for understanding or finding patent violations. ChipWorks is top company in that space. So, it's my recommendation of a practice that's being done right now vs you're recommendation to change everything in an impossible way. I stand by mine.

nickpsecurity 10y ago

Or just do it with open code & hardware on an ASIC whose process node is verifiable by eye with a microscope against a reference image after samples of it are decapped. Either by the owner or numerous third parties. You make it sound much harder than it is unless they're using unverifiable technology. In that case, it might be pretty hard. ;)

Godel_unicode 10y ago
That's ridiculous. People can't reliably produce good implementations of crypto software, and you suggest they design and verify ASICs? My point was that security is about understanding and accepting, not foolishly trying to eliminate, risk. Just a few of the mountains which need climbing: First, you'd need a (actually) random sampling not just one (keep in mind any ASIC you test is likely a write-off due to tamper-resistance). You'd also need a high assurance supply chain to ensure your verification isn't premature (as well as sufficient levels of tamper resistance/evidence). You'd further need to verify the software around this hypothetical ASIC is free of bugs. You're restricting yourself to software which can be performant on older slower process nodes. You (almost certainly not an ASIC company) need to have an in-house ASIC shop, or you need to vet an external one (sounds cheap and easy for the average business). In fact, you need vetting of your internal staff at all stages of this process. You are making this seem _much_ easier than it is. There's a reason this product, which there is definitely a market for, doesn't exist (and that reason is much more mundane than the cryptolluminati not wanting it to "get out"). Consider that Google did something like what you're suggesting. It took them years (and they're Google), what chance does the average person/SMB have?
- hvidgaard 10y ago
  I suppose you could use an fpga, but you still need to audit the assembly line. It's not simple, and you will place trust somewhere.
  - hwh 10y ago
    So, more turtles waiting down there.... In the end, it is the attempt to create a positive proof in a system that is not a defined formal system (real world vs pure mathematics). Impossible - as you say, you need to place your trust somewhere. Even if it's your own abilities. But that trust can always turn out to be not justified.
    - nickpsecurity 10y ago
      You need to make a simple interpreter or processor that's verified by eye, brute force, or mathematically. An old example was FM9001 with newer ones being VAMP (open?) and AAMP7G (proprietary). You do that on a node you can verify by eye. You verify a random sample of the pile you ordered by eye. You use it with cheapest, simplest, oldest parts for input and display that you ordered in obfuscated way so they don't think source of order was important. Then, you have hardware you can trust to do the rest of the calculations for trustworthy hardware or software that's much better. Including image recognition software to semi-automate your job of spotting things that don't below in images of chips. ;)
  - nickpsecurity 10y ago
    Use my same trick but with FPGA's. Those on older nodes barely have any logic gates, though. Another trick for the wealthy is using the latest node that's so cutting-edge they can barely get stuff to work at all. Hard to do some subversion of a black box if state-of-the-art verification barely made that black box functional to begin with.
- nickpsecurity 10y ago
  "That's ridiculous. People can't reliably produce good implementations of crypto software, and you suggest they design and verify ASICs? " You suggested that they verify or perfect every person or thing in the entire supply chain. That was ridiculous. I suggested they or trusted, third parties simply verify an ASIC. That's doable. Matter of fact, people already tear down and image ASIC's on older nodes for fun. A number of companies and labs tear down modern ASIC's to reverse engineer them for understanding or finding patent violations. ChipWorks is top company in that space. So, it's my recommendation of a practice that's being done right now vs you're recommendation to change everything in an impossible way. I stand by mine.