3 ms·
> What is desperately needed is the hardware equivalent of a software checksum, to verify that the device conforms to specs. The problem is, how can you know t
by shawnz 6y ago
> What is desperately needed is the hardware equivalent of a software checksum, to verify that the device conforms to specs.
The problem is, how can you know the OS hasn't been replaced with a fake that bypasses the checksum and keylogs your password?
Without Secure Boot, a TPM already accomplishes what you're asking -- it won't release the disk encryption key to the OS unless the "hardware checksum" is correct.
- MayeulC 6y agoA TPM usually only checks the software (firmware), you could theoretically plant something in the hardware and have it undetected by the TPM. I am pretty sure there is no way to achieve that currently, but with such a concept, the device performing the checksum would be trusted (like a USB stick with verified HW+SW). An example of such a hardware checksum might be a turntable, used to compute the inertia matrix of your hardware. Most tampering (like the bloomberg story plant) should be detectable, up to a certain scale. Unfortunately, it can be compensated, and is not effective against some classes of attacks (frying components, microscopic circuit tampering, etc). It depends on your threat model, anyway.