4 ms·

A much nicer solution would be a move the static root of trust off the CPU package. The motherboard’s EC could easily verify a BIOS signature before allowing bo

by amluto 5y ago

A much nicer solution would be a move the static root of trust off the CPU package. The motherboard’s EC could easily verify a BIOS signature before allowing boot with no CPU involvement whatsoever.

qmarchi 5y ago
See: The Sony PS3
NablaSquaredG 5y ago
As far as I know, Intel does exactly that (or at least allows vendors to do that, I think HP does that) IIRC, in Intel's case, the chipset has the vendor keys burned into it. This is not an issue, as the chipset is not a part you would remove from the board and use elsewhere.
- my123 5y ago
  In Intel’s case the ME as a whole is on the PCH.
- amluto 5y ago
  Intel’s or AMD’s assistance is not needed at all. There is a rather boring flash chip connected by SPI to the CPU and/or PCH. One could interpose a microcontroller that verifies whatever it pleases on that SPI link.
  - my123 5y ago
    That’s the approach used by the Apple T2. On the Intel side, it’s the chipset soldered on the motherboard which does that verification, so CPU swapping isn’t affected.
rasz 5y ago
AMD CPUs are full SOCs nowadays. Everything is on CPU die.
MertsA 5y ago
I think part of the motivation here is tying it in with the PSP and having the root of trust be the processor and not processor for some stuff and motherboard for others. For PSP related stuff it does make sense to centralize on AMD rather than having every vendor have their own implementation of some platform security standard. It's dumb to let motherboards effectively brick a CPU but there reasonably could be a way to have the root of trust on the CPU and extend that to firmware signatures so you could remotely attest BIOS versions, etc. I've mentioned this elsewhere but they could have just added some way of writing this signature out of band or allow bypassing it via a solder bridge on the top of the package like how SPD works on memory but require a separate interface for writing to it. Requiring a $10 I2C to USB adapter to change the key is not that onerous and it would be simple enough for OEMs to flash whatever they wanted on it and it could still be cleared for resale. For protecting against an APT doing shipment interdiction attacks quite frankly that sounds like a bunch of B.S. as all locking the key on the processor does is require the processor to be swapped out during an attack as well. If someone is going through the effort to intercept hardware in transit to flash custom malicious firmware on it, the cost of swapping the processor as well is not that extreme. If they're going to keep the strategy of blowing fuses on the CPU die then AMD should be the ones doing it and they should make a vendor specific SKU so that trying to figure out if a CPU is vendor locked or not isn't such a minefield.

by amluto 5y ago

qmarchi 5y ago

See: The Sony PS3

NablaSquaredG 5y ago

As far as I know, Intel does exactly that (or at least allows vendors to do that, I think HP does that) IIRC, in Intel's case, the chipset has the vendor keys burned into it. This is not an issue, as the chipset is not a part you would remove from the board and use elsewhere.

my123 5y ago
In Intel’s case the ME as a whole is on the PCH.
amluto 5y ago
Intel’s or AMD’s assistance is not needed at all. There is a rather boring flash chip connected by SPI to the CPU and/or PCH. One could interpose a microcontroller that verifies whatever it pleases on that SPI link.
- my123 5y ago
  That’s the approach used by the Apple T2. On the Intel side, it’s the chipset soldered on the motherboard which does that verification, so CPU swapping isn’t affected.

rasz 5y ago

AMD CPUs are full SOCs nowadays. Everything is on CPU die.

MertsA 5y ago

I think part of the motivation here is tying it in with the PSP and having the root of trust be the processor and not processor for some stuff and motherboard for others. For PSP related stuff it does make sense to centralize on AMD rather than having every vendor have their own implementation of some platform security standard. It's dumb to let motherboards effectively brick a CPU but there reasonably could be a way to have the root of trust on the CPU and extend that to firmware signatures so you could remotely attest BIOS versions, etc. I've mentioned this elsewhere but they could have just added some way of writing this signature out of band or allow bypassing it via a solder bridge on the top of the package like how SPD works on memory but require a separate interface for writing to it. Requiring a $10 I2C to USB adapter to change the key is not that onerous and it would be simple enough for OEMs to flash whatever they wanted on it and it could still be cleared for resale. For protecting against an APT doing shipment interdiction attacks quite frankly that sounds like a bunch of B.S. as all locking the key on the processor does is require the processor to be swapped out during an attack as well. If someone is going through the effort to intercept hardware in transit to flash custom malicious firmware on it, the cost of swapping the processor as well is not that extreme. If they're going to keep the strategy of blowing fuses on the CPU die then AMD should be the ones doing it and they should make a vendor specific SKU so that trying to figure out if a CPU is vendor locked or not isn't such a minefield.