4 ms·

Does AMD's PSP have the same security vulnerability?

by z_open 9y ago

freeone3000 9y ago
Likely not the same, due to independent implementation, but it'd be foolish to think it didn't have security flaws equally as severe.
- blauditore 9y ago
  Can you elaborate? From what I understand (I'm not well-informed though), those security flaws stem mainly from carelessness by Intel. So this would assume AMD acts equally careless, which may or may not be true.
  - gh02t 9y ago
    I think the argument is that AMD's implementation is similar in complexity and any sufficiently complex implementation will likely have vulnerabilities, sloppy or not.
  - brudgers 9y ago
    The assumption that the flaws arise from the complexity of contemporary CPU's rather than incompetence within the engineering teams at the world's leading CPU company is probably more useful. When problems come to light, those problems are latent bugs. The engineering was equally competent before and after the latent bugs became known bugs. Bugs with decades long latency are most likely to be non-obvious. In engineering terms, the bugs are "errors and omissions" not carelessness or negligence. Errors and omissions arise because humans are fallible and engineering is a human process. One of the features of Intel (and AMD) products is that their primary customers are data centers and that's where the core CPU design parameters come from (not consumers or developers). The consumer/developer SKU's are little more than repackaging and feature tweaking of the chips that Intel/AMD sells datacenters in high volume on 1-3 year cycles. That's what drives the roadmap five+ years out.
dijit 9y ago
Last I heard about PSP is that it's a supplier of things like TPM but does not have network functionality akin to AMT/vPro. If true then it really limits the attack surface.
- garmaine 9y ago
  This is incorrect. PSP is explicitly a match to vPro in terms of features, including offline network asset management.
  - dijit 9y ago
    You're going to have to back that up. I have never found a shred of evidence to support that it has a network stack. I don't believe it's been explicitly denied either, but I also don't find software that leverages deployments using PSP (or, Secure Processor, as it's now known) unlike what I find for Intels ME/AMT. All indicators point to them focusing on it as a Trusted Execution Environment, similar to secure enclave.

Does AMD's PSP have the same security vulnerability?

by z_open 9y ago

Does AMD's PSP have the same security vulnerability?

Likely not the same, due to independent implementation, but it'd be foolish to think it didn't have security flaws equally as severe.

blauditore 9y ago
Can you elaborate? From what I understand (I'm not well-informed though), those security flaws stem mainly from carelessness by Intel. So this would assume AMD acts equally careless, which may or may not be true.
- gh02t 9y ago
  I think the argument is that AMD's implementation is similar in complexity and any sufficiently complex implementation will likely have vulnerabilities, sloppy or not.
- brudgers 9y ago
  The assumption that the flaws arise from the complexity of contemporary CPU's rather than incompetence within the engineering teams at the world's leading CPU company is probably more useful. When problems come to light, those problems are latent bugs. The engineering was equally competent before and after the latent bugs became known bugs. Bugs with decades long latency are most likely to be non-obvious. In engineering terms, the bugs are "errors and omissions" not carelessness or negligence. Errors and omissions arise because humans are fallible and engineering is a human process. One of the features of Intel (and AMD) products is that their primary customers are data centers and that's where the core CPU design parameters come from (not consumers or developers). The consumer/developer SKU's are little more than repackaging and feature tweaking of the chips that Intel/AMD sells datacenters in high volume on 1-3 year cycles. That's what drives the roadmap five+ years out.

dijit 9y ago

Last I heard about PSP is that it's a supplier of things like TPM but does not have network functionality akin to AMT/vPro. If true then it really limits the attack surface.

garmaine 9y ago
This is incorrect. PSP is explicitly a match to vPro in terms of features, including offline network asset management.
- dijit 9y ago
  You're going to have to back that up. I have never found a shred of evidence to support that it has a network stack. I don't believe it's been explicitly denied either, but I also don't find software that leverages deployments using PSP (or, Secure Processor, as it's now known) unlike what I find for Intels ME/AMT. All indicators point to them focusing on it as a Trusted Execution Environment, similar to secure enclave.