5 ms·

> Out of interest: What would one consider as the most secure, commercially available computer architecture? Define your limits. For the everyday, you won't

by shakna 8y ago

> Out of interest: What would one consider as the most secure, commercially available computer architecture? Define your limits. For the everyday, you won't get far. Intel, AMD and others have all been shown to have problems like this, or at least things they specify for government agencies. However, tiny computer architectures like MIPS, AVR and the like probably don't, simply because they tend to be too small. They don't have the memory for advanced backdoor techniques... But are trivial to access their memory if you have physical access. Straight-up RISC-V is too new to truly trust security, but looks fairly great... Until you realise that almost everyone is going to add their own proprietary extensions to it, and those extensions may well include things like VISA. --- The Raspberry Pi uses a Broadcom ARM chip. (Which model you get does have different models of the particular SoC, and the two main chips are vastly different). I don't have enough details about the particular chip to tell, but ARM does have it's own remote management system. It may or may not be part of what Broadcom offers, and may or may not have undisclosed abilities to offer to clandestine agencies.

MisterTea 8y ago
> Straight-up RISC-V is too new to truly trust security, but looks fairly great... Bad analogy because Risc-V is an instruction set, not a physical microarchitecture. Back doors and side channel attacks could still be possible when implementing risc-v as a uarch. The same applies for any ISA be it MIPS, x86-64, Power, Arm, Spark, PA Risc, Alpha, etc. They're just different programming languages implemented in hardware. And like software, hardware can have bugs too, though patching is much harder or impossible.
- tyingq 8y ago
  Your quote cut off the parent right before they made roughly the same observation.
  - int_19h 8y ago
    Not really - it was talking about proprietary extensions to the instruction set, but the real problem is on implementation level. You can implement most everything strictly to the spec, and still have vulnerable side channels.
kosma 8y ago
Most small microcontrollers are vulnerable to program memory extraction and replacement - even the supposedly secure ones.
wuschel 8y ago
Thanks for your elaboration. What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? I could go back to really old systems, but it does not make really sense to use the 'security through obfuscation' strategy, no?
- shakna 8y ago
  > What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? Tradeoffs, and motivations, really. This is going into the land of speculation and opinion, but I think that we did see some more secure CPUs in the past. I also expect that the military and some industries may have access to more secure versions of CPUs currently on the market. Being more performant became one priority, which lead to do unsafe things that allowed Spectre and others to become possible. And on the other hand, the more diverse and prolific technology becomes, the more interested in being able to access it in a surreptitious manner the government is. Many modern governments seem obsessed with getting as much data as they can - so much they can't even read it all. So on one hand you have pressure from consumers to improve speed at any cost, and on the other you have state actors pressuring to keep the status quo of semi-leaky hardware.
  - wuschel 8y ago
    Thanks. Your speculations sound reasonable. I have no idea what kind of error checking procedure the CPU industry uses, but it is hard to believe that Intel et al. do not use highly integrated proof tools that cover multiple design layers. I know that these are very complex systems, that you can't cover certain cases with proof tools, and cost might be a factor at play - but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now.
    - shakna 8y ago
      > but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now. There's certainly some interest, in some parts of industry. NASA [0] has an FPGA board they made to be more rugged, for CubeSats, which had multiple layers for preventing program corruption. I'd be shocked if it had a backdoor into it, and would expect parts of the system would make it more resistant to tampering. Unfortunately, I also expect that if any chip becomes something popular among consumers, state actors will push their weight and get their weaknesses. [0] https://www.nasa.gov/mission_pages/station/research/experiments/1998.html https://www.nasa.gov/mission_pages/station/research/experime...

by shakna 8y ago

MisterTea 8y ago

> Straight-up RISC-V is too new to truly trust security, but looks fairly great... Bad analogy because Risc-V is an instruction set, not a physical microarchitecture. Back doors and side channel attacks could still be possible when implementing risc-v as a uarch. The same applies for any ISA be it MIPS, x86-64, Power, Arm, Spark, PA Risc, Alpha, etc. They're just different programming languages implemented in hardware. And like software, hardware can have bugs too, though patching is much harder or impossible.

tyingq 8y ago
Your quote cut off the parent right before they made roughly the same observation.
- int_19h 8y ago
  Not really - it was talking about proprietary extensions to the instruction set, but the real problem is on implementation level. You can implement most everything strictly to the spec, and still have vulnerable side channels.

kosma 8y ago

Most small microcontrollers are vulnerable to program memory extraction and replacement - even the supposedly secure ones.

wuschel 8y ago

Thanks for your elaboration. What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? I could go back to really old systems, but it does not make really sense to use the 'security through obfuscation' strategy, no?

shakna 8y ago
> What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? Tradeoffs, and motivations, really. This is going into the land of speculation and opinion, but I think that we did see some more secure CPUs in the past. I also expect that the military and some industries may have access to more secure versions of CPUs currently on the market. Being more performant became one priority, which lead to do unsafe things that allowed Spectre and others to become possible. And on the other hand, the more diverse and prolific technology becomes, the more interested in being able to access it in a surreptitious manner the government is. Many modern governments seem obsessed with getting as much data as they can - so much they can't even read it all. So on one hand you have pressure from consumers to improve speed at any cost, and on the other you have state actors pressuring to keep the status quo of semi-leaky hardware.
- wuschel 8y ago
  Thanks. Your speculations sound reasonable. I have no idea what kind of error checking procedure the CPU industry uses, but it is hard to believe that Intel et al. do not use highly integrated proof tools that cover multiple design layers. I know that these are very complex systems, that you can't cover certain cases with proof tools, and cost might be a factor at play - but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now.
  - shakna 8y ago
    > but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now. There's certainly some interest, in some parts of industry. NASA [0] has an FPGA board they made to be more rugged, for CubeSats, which had multiple layers for preventing program corruption. I'd be shocked if it had a backdoor into it, and would expect parts of the system would make it more resistant to tampering. Unfortunately, I also expect that if any chip becomes something popular among consumers, state actors will push their weight and get their weaknesses. [0] https://www.nasa.gov/mission_pages/station/research/experiments/1998.html https://www.nasa.gov/mission_pages/station/research/experime...