5 ms·
What if firmware or other updates have to be signed to be accepted? Who manages the private key(s) when a vendor goes under? How are they distributed and to who
by aerostable_slug 4y ago
What if firmware or other updates have to be signed to be accepted? Who manages the private key(s) when a vendor goes under? How are they distributed and to whom? I'd worry less with nuclear plant owner/operators as they are used to safeguarding certain types of information, but let's imagine something like firmware for large transformers or other critical infrastructure where security postures vary across owner/operators.
- Dylan16807 4y agoThen you need to add a way for users to alter the trusted keys. Make it require physical access. If someone has physical access they could always throw a wrench into it. The whole idea of allowing alternate firmware is that it shouldn't need the original keys.
- aerostable_slug 4y agoI'd support that as long as there are exemptions for those devices that aren't quite like a consumer iPad. For example, there are a range of devices where your primary threat actors already have physical access to the device in question and it's important to prevent tampering. These can include electric, gas, and water meters on homes and businesses; computing devices in correctional settings; certain military systems; gaming (gambling) systems like slot machines; etc. They aren't the usual use case but they are real and they are out there in significant numbers.
- Dylan16807 4y agoDon't make an exception for almost any of those, add in functionality so the administrator can set a password and lock it. You still don't want the manufacturer to have ultimate power. Maybe for a gambling machine you'd do it differently, but those are already very specially handled.