3 ms·

Why doesn't hardware cryptographically attests manufacturer authenticity? Analog Devices had an article about it from 2014 I just posted https://news.ycombinato

Why doesn't hardware cryptographically attests manufacturer authenticity? Analog Devices had an article about it from 2014 I just posted https://news.ycombinator.com/item?id=35225102 https://news.ycombinator.com/item?id=35225102

wtallis 4y ago
PCI vendor IDs are quite a bit older than 2014. Likewise for the USB ecosystem. It would not be easy to retrofit cryptographic signing into these systems without breaking a lot of vital functionality or making the security a toothless opt-in system. Verifying the authenticity of every component of the system is only viable when it's a relatively closed system: embedded devices, smartphones, etc. Narrowly-focused authentication systems like HDCP have had some success, but doing that for every peripheral and replaceable component in a PC would be a monumental project.
- andromaton 4y ago
  Perhaps it's not easy or fast, but it's unavoidable.
  - wtallis 4y ago
    The PC industry seems to be getting along just find avoiding your "solution".
    - andromaton 4y ago
      Not sure why the scare quotes. Counterfits are a reliability and security risk.
      - wtallis 4y ago
        You seem to think the industry needs a perfectly effective counter to those risks, no matter the cost. You don't seem at all willing to consider that your proposed solution may be impractical or more of a problem than what you're seeking to solve. You're also refusing to accept the long-standing status quo as evidence that the problem is actually fairly manageable without the solution you claim is unavoidable. So overall, it's pretty clear your original question of why the industry isn't working toward that kind of solution was not an honest question you wanted answered, but merely a rhetorical opening for you to preach your cause.
        andromaton 4y ago
        It was a real question. I expected a historic or technical answer. Did not expect antipathy.
        MichaelZuo 4y ago
        > Perhaps it's not easy or fast, but it's unavoidable. It is pretty easy to imagine a future where it simply never happens.
        MiguelX413 4y ago
        Likewise, it's not that hard for me to imagine one where it does eventually happen.
        MichaelZuo 4y ago
        Right, but the parent used the word 'unavoidable' which implies that such a future is pre-ordained. Which obviously doesn't make any sense.
- andromaton 4y ago
  Self correction: it's not unavoidable. I'm thinking long term we need a way to trust hardware, and I see cryptography as a way to do it. Short term, I really want a charger or sd card labelled Samsung not to be made by a reputation-less, liability less, no skin in the game, anonymous copy cat. I don't want to become an art fraud detective, comparing fonts and kernel spacing, or chipsets. Chips are also sometimes fraudulently labelled.
- vladvasiliu 4y ago
  You wouldn't have to have an automatic, full-verification system. But I'd expect that for components likely to be easy targets for counterfeiting, the manufacturer's software should be able to verify it with a relatively high degree of confidence. But that doesn't seem to be the case here, according to TFA: > The forgery was so good that the mysterious drive even managed to fool the Samsung Magician software.
Am4TIfIsER0ppos 4y ago
Oh that sounds great. It totally isn't DRM for hardware. "Sorry your motherboard is not allowed to use this disk. For your own safety."
- andromaton 4y ago
  Websites cryptographically sign their name. Browsers don't completely block those that don't. Nobody complains about it.
- nicolaslem 4y ago
  Doesn't Lenovo already do that with wlan cards?

wtallis 4y ago

PCI vendor IDs are quite a bit older than 2014. Likewise for the USB ecosystem. It would not be easy to retrofit cryptographic signing into these systems without breaking a lot of vital functionality or making the security a toothless opt-in system. Verifying the authenticity of every component of the system is only viable when it's a relatively closed system: embedded devices, smartphones, etc. Narrowly-focused authentication systems like HDCP have had some success, but doing that for every peripheral and replaceable component in a PC would be a monumental project.

andromaton 4y ago
Perhaps it's not easy or fast, but it's unavoidable.
- wtallis 4y ago
  The PC industry seems to be getting along just find avoiding your "solution".
  - andromaton 4y ago
    Not sure why the scare quotes. Counterfits are a reliability and security risk.
    - wtallis 4y ago
      You seem to think the industry needs a perfectly effective counter to those risks, no matter the cost. You don't seem at all willing to consider that your proposed solution may be impractical or more of a problem than what you're seeking to solve. You're also refusing to accept the long-standing status quo as evidence that the problem is actually fairly manageable without the solution you claim is unavoidable. So overall, it's pretty clear your original question of why the industry isn't working toward that kind of solution was not an honest question you wanted answered, but merely a rhetorical opening for you to preach your cause.
      - andromaton 4y ago
        It was a real question. I expected a historic or technical answer. Did not expect antipathy.
        MichaelZuo 4y ago
        > Perhaps it's not easy or fast, but it's unavoidable. It is pretty easy to imagine a future where it simply never happens.
        MiguelX413 4y ago
        Likewise, it's not that hard for me to imagine one where it does eventually happen.
        MichaelZuo 4y ago
        Right, but the parent used the word 'unavoidable' which implies that such a future is pre-ordained. Which obviously doesn't make any sense.
andromaton 4y ago
Self correction: it's not unavoidable. I'm thinking long term we need a way to trust hardware, and I see cryptography as a way to do it. Short term, I really want a charger or sd card labelled Samsung not to be made by a reputation-less, liability less, no skin in the game, anonymous copy cat. I don't want to become an art fraud detective, comparing fonts and kernel spacing, or chipsets. Chips are also sometimes fraudulently labelled.
vladvasiliu 4y ago
You wouldn't have to have an automatic, full-verification system. But I'd expect that for components likely to be easy targets for counterfeiting, the manufacturer's software should be able to verify it with a relatively high degree of confidence. But that doesn't seem to be the case here, according to TFA: > The forgery was so good that the mysterious drive even managed to fool the Samsung Magician software.

Am4TIfIsER0ppos 4y ago

Oh that sounds great. It totally isn't DRM for hardware. "Sorry your motherboard is not allowed to use this disk. For your own safety."

andromaton 4y ago
Websites cryptographically sign their name. Browsers don't completely block those that don't. Nobody complains about it.
nicolaslem 4y ago
Doesn't Lenovo already do that with wlan cards?