6 ms·

Out of interest: What would one consider as the most secure, commercially available computer architecture? Are there any open, vetted computer system out there

Out of interest: What would one consider as the most secure, commercially available computer architecture? Are there any open, vetted computer system out there? How do projects such as the Raspberry Pi fare in terms of security?

sabujp 8y ago
There are many, but you'll sacrifice either price or performance to get it. The problem is that for hardware qualification/testing/development, remote management, etc many vendors have started opening up these backdoors.
shakna 8y ago
> Out of interest: What would one consider as the most secure, commercially available computer architecture? Define your limits. For the everyday, you won't get far. Intel, AMD and others have all been shown to have problems like this, or at least things they specify for government agencies. However, tiny computer architectures like MIPS, AVR and the like probably don't, simply because they tend to be too small. They don't have the memory for advanced backdoor techniques... But are trivial to access their memory if you have physical access. Straight-up RISC-V is too new to truly trust security, but looks fairly great... Until you realise that almost everyone is going to add their own proprietary extensions to it, and those extensions may well include things like VISA. --- The Raspberry Pi uses a Broadcom ARM chip. (Which model you get does have different models of the particular SoC, and the two main chips are vastly different). I don't have enough details about the particular chip to tell, but ARM does have it's own remote management system. It may or may not be part of what Broadcom offers, and may or may not have undisclosed abilities to offer to clandestine agencies.
- MisterTea 8y ago
  > Straight-up RISC-V is too new to truly trust security, but looks fairly great... Bad analogy because Risc-V is an instruction set, not a physical microarchitecture. Back doors and side channel attacks could still be possible when implementing risc-v as a uarch. The same applies for any ISA be it MIPS, x86-64, Power, Arm, Spark, PA Risc, Alpha, etc. They're just different programming languages implemented in hardware. And like software, hardware can have bugs too, though patching is much harder or impossible.
  - tyingq 8y ago
    Your quote cut off the parent right before they made roughly the same observation.
    - int_19h 8y ago
      Not really - it was talking about proprietary extensions to the instruction set, but the real problem is on implementation level. You can implement most everything strictly to the spec, and still have vulnerable side channels.
- kosma 8y ago
  Most small microcontrollers are vulnerable to program memory extraction and replacement - even the supposedly secure ones.
- wuschel 8y ago
  Thanks for your elaboration. What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? I could go back to really old systems, but it does not make really sense to use the 'security through obfuscation' strategy, no?
  - shakna 8y ago
    > What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? Tradeoffs, and motivations, really. This is going into the land of speculation and opinion, but I think that we did see some more secure CPUs in the past. I also expect that the military and some industries may have access to more secure versions of CPUs currently on the market. Being more performant became one priority, which lead to do unsafe things that allowed Spectre and others to become possible. And on the other hand, the more diverse and prolific technology becomes, the more interested in being able to access it in a surreptitious manner the government is. Many modern governments seem obsessed with getting as much data as they can - so much they can't even read it all. So on one hand you have pressure from consumers to improve speed at any cost, and on the other you have state actors pressuring to keep the status quo of semi-leaky hardware.
    - wuschel 8y ago
      Thanks. Your speculations sound reasonable. I have no idea what kind of error checking procedure the CPU industry uses, but it is hard to believe that Intel et al. do not use highly integrated proof tools that cover multiple design layers. I know that these are very complex systems, that you can't cover certain cases with proof tools, and cost might be a factor at play - but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now.
      - shakna 8y ago
        > but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now. There's certainly some interest, in some parts of industry. NASA [0] has an FPGA board they made to be more rugged, for CubeSats, which had multiple layers for preventing program corruption. I'd be shocked if it had a backdoor into it, and would expect parts of the system would make it more resistant to tampering. Unfortunately, I also expect that if any chip becomes something popular among consumers, state actors will push their weight and get their weaknesses. [0] https://www.nasa.gov/mission_pages/station/research/experiments/1998.html https://www.nasa.gov/mission_pages/station/research/experime...
tyingq 8y ago
"How do projects such as the Raspberry Pi fare in terms of security?" The CPU on that isn't the first thing that boots. There's a binary blob that boots the GPU first, and gets it to boot the CPU. There is some progress on being able to boot without the mystery code, but it's not complete: https://hackaday.com/2017/01/14/blob-less-raspberry-pi-linux-is-a-step-closer/ https://hackaday.com/2017/01/14/blob-less-raspberry-pi-linux... Broadcom offers very little documentation. I don't think an RPi would be a good security choice. A Beaglebone Black has a better documented CPU and boot process, and can run stock, non custom Linux. Not specifically "secure", per se, but is at least easier to research. Can't vouch for it, but here's an attempt to make the BBB a secure environment: https://cryptotronix.com/products/cryptocape/ https://cryptotronix.com/products/cryptocape/
- wuschel 8y ago
  Thanks for the link!
posnet 8y ago
https://www.raptorcs.com/ https://www.raptorcs.com/ They have a powerpc based desktop system where every component has its firmware open and available.
- justinjlynn 8y ago
  The processors have complete internal and internal configuration register documentation available, as well.
- Koshkin 8y ago
  > NOTE: The proprietary NVIDIA® driver stack does not support OpenGL. There is no way to add OpenGL support to the proprietary driver stack. This system is designed for GPU compute, and while a minimal 2D framebuffer is supported 3D applications will fall back to non-accelerated LLVMPipe rendering. This may result in modern desktop environments, such as KDE and Gnome, failing to operate at an acceptable speed. (No comment.)
  - classichasclass 8y ago
    That's their PowerAI node. Their regular hardware is sold with AMD workstation cards and uses amdgpu like everything else. (Talos II owner.)
- edwintorok 8y ago
  Also see https://www.raptorcs.com/BB/ https://www.raptorcs.com/BB/ for their latest, more affordable board called Blackbird.
walterbell 8y ago
Lenovo X230 with Heads, me_cleaner, Qubes. Used OpenCompute enterprise server from eBay, with LinuxBoot as BIOS. Future: OpenCompute platform based on OpenPower CPU, Open System Firmware and an open-hardware implementation of Microsoft Cerberus / Google OpenTitan.
- wuschel 8y ago
  Interesting. Are there no known backdoors in the Lenovo X200/.../X230 Intel systems? I remember some bad news about Active Management Technologies. How far along are these Open Architecture Systems?
  - confounded 8y ago
    At least with the X200 you can run Libreboot, a fully blob-free subset of coreboot. The AMT stuff can be flashed off the chip.
  - neilv 8y ago
    The me_cleaner they mentioned is an attempt to remove/disable the Intel ME, including any AMT. An alternative to me_cleaner on some systems (like ThinkPad X200) is to replace the BIOS entirely with Coreboot [1]. More recently, it was found that me_cleaner appears to let you remove/disable all or part of Intel ME on those and some other architectures but still boot. [1] My own notes from when I played with this, which was a mixed success (it was way too much headache to have a huge number of people each do): https://www.neilvandyke.org/coreboot/ https://www.neilvandyke.org/coreboot/
- deleted 8y ago
  [deleted]
- confounded 8y ago
  Another server option is something based on ~2012 Opterton chips which have been freed, such as: https://store.vikings.net/libre-friendly-hardware/the-server-1u https://store.vikings.net/libre-friendly-hardware/the-server...
bo1024 8y ago
There are two avenues: 1. Take an Intel or AMD system and try to secure-ify it. This is what vendors like system76[1] and Purism[2] do, especially aided by the coreboot project[3]. I'm not an expert on the details, but an important goal in this space has been disabling Intel ME[4], which I note in the original parent article seems to be part of this exploit (at least when used remotely). AMD has a corresponding parasite cpu-in-cpu, not sure about progress on disabling. 2. Use another CPU. Someone else mentioned the raptor project, that's all I know of (but again I'm not an expert). But by far the most common consumer CPU that competes with Intel and AMD, who make x86 processors, is the ARM platform used by phones, Raspberry Pis, and many embedded devices. Note the CPU is only one kind of closed firmware that can have backdoors or insecurities.... [1] https://system76.com/ https://system76.com/ [2] https://puri.sm/ https://puri.sm/ [3] https://www.coreboot.org/ https://www.coreboot.org/ [4] https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine
- wuschel 8y ago
  Hi, thanks for the links Indeed, the control and understanding of the CPU (and auxiliary chips) is key. A naive question: what are the resources needed to get your own CPU architecture going, not necessarily state of the art, but older technology? The fabrication technology is there, after all. And many a patent should be expired by now. Also, there must be some academic projects out there which build such complex systems.
  - dbdjfjrjvebd 8y ago
    I don't know much about this but I guess you could check out RISC V
- djsumdog 8y ago
  With Intel/AMD x86_64 chips, you have a platform to go with it: the PC architecture. The BIOS/UEFI in this architecture is incredibly standard over the course of their offerings. The PlayStation 4 has an x86 chip, but is not a PC. It cannot boot a mainline kernel because a lot of basic assumptions about how a PC works don't exist on the PS4 platform. The Fail0ver people have done some great talks at all the issues porting Linux to the PS4. The trouble with ARM is that it's not an architecture. Linux got so popular among developers and nerds in the 90s because you could just install it on any PC that was out there. When people got hardware working, they could upstream their changes. Phone manufactures patch the hell out of their kernels in terrible ways that can never be up-streamed, and include tons of binary blobs and shims. PostmarketOS is making some progress here, but it's slow. ARM phones don't have a standard BIOS. (with the exception of the Windows Mobile line, which has ARM+UEFI, yet Microsoft still won't release a bootloader unlock even though their phone is pretty much dead at this point). Some ARM devices use the devicetree standard for hardware identification/allocation, but it's still a mess. I wrote about this before: https://penguindreams.org/blog/android-fragmentation/ https://penguindreams.org/blog/android-fragmentation/
Gladdyu 8y ago
The most certainty you are going to get is by taking an open source processor core, and run it on an FPGA with an open toolchain. You won't be able to check the actual FPGA chip, though the risk seems minimal on that front compared to ASICs with the ISA baked in. You will pay dearly in cost, performance and pretty much every other metric that you care about though.
voldacar 8y ago
>Are there any open, vetted computer system out there? Raptor Talos II comes to mind. Quite powerful, and fully auditable firmware. Uses an IBM POWER9 cpu, no x86

sabujp 8y ago

There are many, but you'll sacrifice either price or performance to get it. The problem is that for hardware qualification/testing/development, remote management, etc many vendors have started opening up these backdoors.

shakna 8y ago

> Out of interest: What would one consider as the most secure, commercially available computer architecture? Define your limits. For the everyday, you won't get far. Intel, AMD and others have all been shown to have problems like this, or at least things they specify for government agencies. However, tiny computer architectures like MIPS, AVR and the like probably don't, simply because they tend to be too small. They don't have the memory for advanced backdoor techniques... But are trivial to access their memory if you have physical access. Straight-up RISC-V is too new to truly trust security, but looks fairly great... Until you realise that almost everyone is going to add their own proprietary extensions to it, and those extensions may well include things like VISA. --- The Raspberry Pi uses a Broadcom ARM chip. (Which model you get does have different models of the particular SoC, and the two main chips are vastly different). I don't have enough details about the particular chip to tell, but ARM does have it's own remote management system. It may or may not be part of what Broadcom offers, and may or may not have undisclosed abilities to offer to clandestine agencies.

MisterTea 8y ago
> Straight-up RISC-V is too new to truly trust security, but looks fairly great... Bad analogy because Risc-V is an instruction set, not a physical microarchitecture. Back doors and side channel attacks could still be possible when implementing risc-v as a uarch. The same applies for any ISA be it MIPS, x86-64, Power, Arm, Spark, PA Risc, Alpha, etc. They're just different programming languages implemented in hardware. And like software, hardware can have bugs too, though patching is much harder or impossible.
- tyingq 8y ago
  Your quote cut off the parent right before they made roughly the same observation.
  - int_19h 8y ago
    Not really - it was talking about proprietary extensions to the instruction set, but the real problem is on implementation level. You can implement most everything strictly to the spec, and still have vulnerable side channels.
kosma 8y ago
Most small microcontrollers are vulnerable to program memory extraction and replacement - even the supposedly secure ones.
wuschel 8y ago
Thanks for your elaboration. What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? I could go back to really old systems, but it does not make really sense to use the 'security through obfuscation' strategy, no?
- shakna 8y ago
  > What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? Tradeoffs, and motivations, really. This is going into the land of speculation and opinion, but I think that we did see some more secure CPUs in the past. I also expect that the military and some industries may have access to more secure versions of CPUs currently on the market. Being more performant became one priority, which lead to do unsafe things that allowed Spectre and others to become possible. And on the other hand, the more diverse and prolific technology becomes, the more interested in being able to access it in a surreptitious manner the government is. Many modern governments seem obsessed with getting as much data as they can - so much they can't even read it all. So on one hand you have pressure from consumers to improve speed at any cost, and on the other you have state actors pressuring to keep the status quo of semi-leaky hardware.
  - wuschel 8y ago
    Thanks. Your speculations sound reasonable. I have no idea what kind of error checking procedure the CPU industry uses, but it is hard to believe that Intel et al. do not use highly integrated proof tools that cover multiple design layers. I know that these are very complex systems, that you can't cover certain cases with proof tools, and cost might be a factor at play - but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now.
    - shakna 8y ago
      > but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now. There's certainly some interest, in some parts of industry. NASA [0] has an FPGA board they made to be more rugged, for CubeSats, which had multiple layers for preventing program corruption. I'd be shocked if it had a backdoor into it, and would expect parts of the system would make it more resistant to tampering. Unfortunately, I also expect that if any chip becomes something popular among consumers, state actors will push their weight and get their weaknesses. [0] https://www.nasa.gov/mission_pages/station/research/experiments/1998.html https://www.nasa.gov/mission_pages/station/research/experime...

tyingq 8y ago

"How do projects such as the Raspberry Pi fare in terms of security?" The CPU on that isn't the first thing that boots. There's a binary blob that boots the GPU first, and gets it to boot the CPU. There is some progress on being able to boot without the mystery code, but it's not complete: https://hackaday.com/2017/01/14/blob-less-raspberry-pi-linux-is-a-step-closer/ https://hackaday.com/2017/01/14/blob-less-raspberry-pi-linux... Broadcom offers very little documentation. I don't think an RPi would be a good security choice. A Beaglebone Black has a better documented CPU and boot process, and can run stock, non custom Linux. Not specifically "secure", per se, but is at least easier to research. Can't vouch for it, but here's an attempt to make the BBB a secure environment: https://cryptotronix.com/products/cryptocape/ https://cryptotronix.com/products/cryptocape/

wuschel 8y ago
Thanks for the link!

posnet 8y ago

https://www.raptorcs.com/ https://www.raptorcs.com/ They have a powerpc based desktop system where every component has its firmware open and available.

justinjlynn 8y ago
The processors have complete internal and internal configuration register documentation available, as well.
Koshkin 8y ago
> NOTE: The proprietary NVIDIA® driver stack does not support OpenGL. There is no way to add OpenGL support to the proprietary driver stack. This system is designed for GPU compute, and while a minimal 2D framebuffer is supported 3D applications will fall back to non-accelerated LLVMPipe rendering. This may result in modern desktop environments, such as KDE and Gnome, failing to operate at an acceptable speed. (No comment.)
- classichasclass 8y ago
  That's their PowerAI node. Their regular hardware is sold with AMD workstation cards and uses amdgpu like everything else. (Talos II owner.)
edwintorok 8y ago
Also see https://www.raptorcs.com/BB/ https://www.raptorcs.com/BB/ for their latest, more affordable board called Blackbird.

walterbell 8y ago

Lenovo X230 with Heads, me_cleaner, Qubes. Used OpenCompute enterprise server from eBay, with LinuxBoot as BIOS. Future: OpenCompute platform based on OpenPower CPU, Open System Firmware and an open-hardware implementation of Microsoft Cerberus / Google OpenTitan.

wuschel 8y ago
Interesting. Are there no known backdoors in the Lenovo X200/.../X230 Intel systems? I remember some bad news about Active Management Technologies. How far along are these Open Architecture Systems?
- confounded 8y ago
  At least with the X200 you can run Libreboot, a fully blob-free subset of coreboot. The AMT stuff can be flashed off the chip.
- neilv 8y ago
  The me_cleaner they mentioned is an attempt to remove/disable the Intel ME, including any AMT. An alternative to me_cleaner on some systems (like ThinkPad X200) is to replace the BIOS entirely with Coreboot [1]. More recently, it was found that me_cleaner appears to let you remove/disable all or part of Intel ME on those and some other architectures but still boot. [1] My own notes from when I played with this, which was a mixed success (it was way too much headache to have a huge number of people each do): https://www.neilvandyke.org/coreboot/ https://www.neilvandyke.org/coreboot/
deleted 8y ago
[deleted]
confounded 8y ago
Another server option is something based on ~2012 Opterton chips which have been freed, such as: https://store.vikings.net/libre-friendly-hardware/the-server-1u https://store.vikings.net/libre-friendly-hardware/the-server...

bo1024 8y ago

There are two avenues: 1. Take an Intel or AMD system and try to secure-ify it. This is what vendors like system76[1] and Purism[2] do, especially aided by the coreboot project[3]. I'm not an expert on the details, but an important goal in this space has been disabling Intel ME[4], which I note in the original parent article seems to be part of this exploit (at least when used remotely). AMD has a corresponding parasite cpu-in-cpu, not sure about progress on disabling. 2. Use another CPU. Someone else mentioned the raptor project, that's all I know of (but again I'm not an expert). But by far the most common consumer CPU that competes with Intel and AMD, who make x86 processors, is the ARM platform used by phones, Raspberry Pis, and many embedded devices. Note the CPU is only one kind of closed firmware that can have backdoors or insecurities.... [1] https://system76.com/ https://system76.com/ [2] https://puri.sm/ https://puri.sm/ [3] https://www.coreboot.org/ https://www.coreboot.org/ [4] https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine

wuschel 8y ago
Hi, thanks for the links Indeed, the control and understanding of the CPU (and auxiliary chips) is key. A naive question: what are the resources needed to get your own CPU architecture going, not necessarily state of the art, but older technology? The fabrication technology is there, after all. And many a patent should be expired by now. Also, there must be some academic projects out there which build such complex systems.
- dbdjfjrjvebd 8y ago
  I don't know much about this but I guess you could check out RISC V
djsumdog 8y ago
With Intel/AMD x86_64 chips, you have a platform to go with it: the PC architecture. The BIOS/UEFI in this architecture is incredibly standard over the course of their offerings. The PlayStation 4 has an x86 chip, but is not a PC. It cannot boot a mainline kernel because a lot of basic assumptions about how a PC works don't exist on the PS4 platform. The Fail0ver people have done some great talks at all the issues porting Linux to the PS4. The trouble with ARM is that it's not an architecture. Linux got so popular among developers and nerds in the 90s because you could just install it on any PC that was out there. When people got hardware working, they could upstream their changes. Phone manufactures patch the hell out of their kernels in terrible ways that can never be up-streamed, and include tons of binary blobs and shims. PostmarketOS is making some progress here, but it's slow. ARM phones don't have a standard BIOS. (with the exception of the Windows Mobile line, which has ARM+UEFI, yet Microsoft still won't release a bootloader unlock even though their phone is pretty much dead at this point). Some ARM devices use the devicetree standard for hardware identification/allocation, but it's still a mess. I wrote about this before: https://penguindreams.org/blog/android-fragmentation/ https://penguindreams.org/blog/android-fragmentation/

Gladdyu 8y ago

The most certainty you are going to get is by taking an open source processor core, and run it on an FPGA with an open toolchain. You won't be able to check the actual FPGA chip, though the risk seems minimal on that front compared to ASICs with the ISA baked in. You will pay dearly in cost, performance and pretty much every other metric that you care about though.

voldacar 8y ago

>Are there any open, vetted computer system out there? Raptor Talos II comes to mind. Quite powerful, and fully auditable firmware. Uses an IBM POWER9 cpu, no x86