3 ms·

Blockchain, however muddied it is today, does have legitimate uses. In this case, we use it to enforce a valid timeline of builds with cryptography.

0x0 8y ago
I don't get it, do you allow adversary participants in on the network to vote on firmware consensus? What's wrong with regular vendor digital signatures, like everyone else does? :)
- jackpot51 8y ago
  No. It is a blockchain, but is not distributed or mined. Firmware is built and signed with the signature of the previous build as part of the artifacts. This, in addition with a constraint that the timestamp can never move backwards, means builds must have a valid timeline and it becomes very difficult to hijack the publishing system. Imagine you want to revert firmware for legitimate reasons. As the originator of the firmware, you could revert the source code and have a new build spawn that produces a valid artifact. With our system and with the typical system, this is possible. Now imagine you are an attacker who wants to release an older firmware version, which potentially contains a vulnerability. You have access to the publishing system, but not the build system or signing key. With our system this is impossible, as consumers will not allow moving backwards to an older build. With the typical system, any signed firmware blob can be released at any time, meaning an older version can be made available without having to rebuild. Our build system utilizes a firmware signing hardware device connected to the build server over serial with a strict protocol to ensure that leaking the key is not possible, even if the build server is compromised. In addition, the key is destroyed if this firmware signing device loses power (it does have a battery backup, but it disconnects if the case is opened), and we must deploy a new key in that event through software upgrades on client machines.
  - 0x0 8y ago
    Sounds really complicated, couldn't you just replace all that blockchain verification code with an "if (firmwareToInstall.version < firmwareCurrentlyInstalled.version) return false" after the signature check?

0x0 8y ago

I don't get it, do you allow adversary participants in on the network to vote on firmware consensus? What's wrong with regular vendor digital signatures, like everyone else does? :)

jackpot51 8y ago
No. It is a blockchain, but is not distributed or mined. Firmware is built and signed with the signature of the previous build as part of the artifacts. This, in addition with a constraint that the timestamp can never move backwards, means builds must have a valid timeline and it becomes very difficult to hijack the publishing system. Imagine you want to revert firmware for legitimate reasons. As the originator of the firmware, you could revert the source code and have a new build spawn that produces a valid artifact. With our system and with the typical system, this is possible. Now imagine you are an attacker who wants to release an older firmware version, which potentially contains a vulnerability. You have access to the publishing system, but not the build system or signing key. With our system this is impossible, as consumers will not allow moving backwards to an older build. With the typical system, any signed firmware blob can be released at any time, meaning an older version can be made available without having to rebuild. Our build system utilizes a firmware signing hardware device connected to the build server over serial with a strict protocol to ensure that leaking the key is not possible, even if the build server is compromised. In addition, the key is destroyed if this firmware signing device loses power (it does have a battery backup, but it disconnects if the case is opened), and we must deploy a new key in that event through software upgrades on client machines.
- 0x0 8y ago
  Sounds really complicated, couldn't you just replace all that blockchain verification code with an "if (firmwareToInstall.version < firmwareCurrentlyInstalled.version) return false" after the signature check?