3 ms·

Not much of a security processor if you can throw whatever firmware you want on it and trick the host OS into thinking it hasn't been tampered with.

by judge2020 5y ago

AnthonyMouse 5y ago
Tricking the host OS into thinking whatever the user wants it to think is a feature of a security processor. How to design secure hardware: The system board contains two copies of the firmware, for which the source code is published. The first copy is fully read-only and cannot be modified after manufacture. The second copy is in flash memory. A switch or jumper on the system board determines which copy is used at boot. Now you can trust your software/firmware (if you could trust it from the factory), because the read-only copy can be used to boot the system in order flash the read-write copy to a trusted (possibly newer or third party) firmware version. This also means that a bad firmware update can't brick your hardware, because you can recover it by using the read-only copy. There is no requirement for the hardware to prove anything to the OS. If the hardware is compromised, this is not actually possible anyway, because it could lie. What you need is for the hardware to be able to prove something to the user, i.e. that the firmware update or operating system they just installed was actually installed and not ignored or modified by some already-compromised read-write firmware.
- mindslight 5y ago
  nit: in order for something to be read-only it's got to be a mask ROM or otherwise burnt-in (rather than merely undocumented flash), which implies being small. So the read only part really just needs to be a well-documented bootloader rather than a whole BIOS partition. Also whenever you hear "security" you need to think "who's security?". Like when you go to the airport they're all on about "security" but it's not your security - you yourself are being made less secure by having to disassemble your person at the checkpoint for their security. Similarly a "security processor", as defined by Big Tech [0], has the goal of making them more secure at the expense of your own security. They can't have you running whatever pesky user-empowering software you want and all that. You might end up believing some of those radical ideas from the 90's! [0] which includes Big Hardware, which we're unfortunately reliant upon due to economies of scale.
  - AnthonyMouse 5y ago
    > in order for something to be read-only it's got to be a mask ROM or otherwise burnt-in (rather than merely undocumented flash), which implies being small. Not necessarily. Suppose you use ordinary flash but the write lines are physically not connected to it so there is no way to write to it from software. In theory someone could desolder it and replace the contents, but if the attacker is desoldering your hardware, you've already lost. > Also whenever you hear "security" you need to think "who's security?". They try to sell people the "security processor" as a feature. It's important to make everyone aware of what it really is.
    - mindslight 5y ago
      > The first copy ... cannot be modified after manufacture A second flash chip with a write disable line would also work, but that's not what you described. For one difference, it allows for evil maid attacks with an external flasher. > But they try to sell people the "security processor" as a feature. It's important to make everyone aware of what it really is. I agree, but it's not productive to just unilaterally define "security processor" the other way and talk past the problem. Either qualify it ("user representing security processor"), or otherwise make it clear that "security" doesn't always imply something good for the user (in fact in consumer marketing material it's more often harmful than good).
  - brirec 5y ago
    You can totally use a multi-stage loader, storing stage 0 and encryption keys on mask ROM. You have to make sure you don’t use a shoddy crypto implementation (or else you end up with something like Wii boothax), but the general concepts aren’t too out there: 1. Load stage zero from maskrom 2. Stage zero loads stage one from flash along with a public signing key from maskrom 3. Stage zero verifies the signature of stage one from vendor. If it’s not valid, halt. 4. Stage zero jumps into stage one. 5. Stage one and later perform the rest of the attestation and booting process. The hardest part is bootstrapping, but it’s really not THAT hard…
    - mindslight 5y ago

Not much of a security processor if you can throw whatever firmware you want on it and trick the host OS into thinking it hasn't been tampered with.

AnthonyMouse 5y ago

Tricking the host OS into thinking whatever the user wants it to think is a feature of a security processor. How to design secure hardware: The system board contains two copies of the firmware, for which the source code is published. The first copy is fully read-only and cannot be modified after manufacture. The second copy is in flash memory. A switch or jumper on the system board determines which copy is used at boot. Now you can trust your software/firmware (if you could trust it from the factory), because the read-only copy can be used to boot the system in order flash the read-write copy to a trusted (possibly newer or third party) firmware version. This also means that a bad firmware update can't brick your hardware, because you can recover it by using the read-only copy. There is no requirement for the hardware to prove anything to the OS. If the hardware is compromised, this is not actually possible anyway, because it could lie. What you need is for the hardware to be able to prove something to the user, i.e. that the firmware update or operating system they just installed was actually installed and not ignored or modified by some already-compromised read-write firmware.

mindslight 5y ago
nit: in order for something to be read-only it's got to be a mask ROM or otherwise burnt-in (rather than merely undocumented flash), which implies being small. So the read only part really just needs to be a well-documented bootloader rather than a whole BIOS partition. Also whenever you hear "security" you need to think "who's security?". Like when you go to the airport they're all on about "security" but it's not your security - you yourself are being made less secure by having to disassemble your person at the checkpoint for their security. Similarly a "security processor", as defined by Big Tech [0], has the goal of making them more secure at the expense of your own security. They can't have you running whatever pesky user-empowering software you want and all that. You might end up believing some of those radical ideas from the 90's! [0] which includes Big Hardware, which we're unfortunately reliant upon due to economies of scale.
- AnthonyMouse 5y ago
  > in order for something to be read-only it's got to be a mask ROM or otherwise burnt-in (rather than merely undocumented flash), which implies being small. Not necessarily. Suppose you use ordinary flash but the write lines are physically not connected to it so there is no way to write to it from software. In theory someone could desolder it and replace the contents, but if the attacker is desoldering your hardware, you've already lost. > Also whenever you hear "security" you need to think "who's security?". They try to sell people the "security processor" as a feature. It's important to make everyone aware of what it really is.
  - mindslight 5y ago
    > The first copy ... cannot be modified after manufacture A second flash chip with a write disable line would also work, but that's not what you described. For one difference, it allows for evil maid attacks with an external flasher. > But they try to sell people the "security processor" as a feature. It's important to make everyone aware of what it really is. I agree, but it's not productive to just unilaterally define "security processor" the other way and talk past the problem. Either qualify it ("user representing security processor"), or otherwise make it clear that "security" doesn't always imply something good for the user (in fact in consumer marketing material it's more often harmful than good).
- brirec 5y ago
  You can totally use a multi-stage loader, storing stage 0 and encryption keys on mask ROM. You have to make sure you don’t use a shoddy crypto implementation (or else you end up with something like Wii boothax), but the general concepts aren’t too out there: 1. Load stage zero from maskrom 2. Stage zero loads stage one from flash along with a public signing key from maskrom 3. Stage zero verifies the signature of stage one from vendor. If it’s not valid, halt. 4. Stage zero jumps into stage one. 5. Stage one and later perform the rest of the attestation and booting process. The hardest part is bootstrapping, but it’s really not THAT hard…
  - mindslight 5y ago