5 ms·

I don't understand how such keys can leak? Hasn't intel heard about locking keys in hardware, e.g. like with hardware security key modules similar but faster/f

I don't understand how such keys can leak? Hasn't intel heard about locking keys in hardware, e.g. like with hardware security key modules similar but faster/flexibler then a TPM. Surly one of the main developers of TPM does understand that concept.... right? /s

pmontra 4y ago
People know keys, people eventually leak keys. It always happened.
- mynameisvlad 4y ago
  The point is that you can't leak a key from a HSM.
  - josefx 4y ago
    On the one hand that is the goal, on the other hand the applicable standard seems to be FIPS 140, which counts products with a flawless security history like OpenSSL amongst its long time adherents. In other words there is a non zero chance that the modules will just spit out the key if you even look at them funny.
29athrowaway 4y ago
Because security is a cost center and business people do not give a shit.
- noizejoy 4y ago
  It’s not just business people. Most humans seem to see security (and safety) as a burden, not as something enjoyable.
  - userbinator 4y ago
    That's because people still generally value freedom over security, and that's a good thing.
XorNot 4y ago
If it's a master key you can't run the business risk of losing access to it.
- dathinab 4y ago
  you don't have that risk there are more then just one or two ways to not have that risk and still have HSK best many of this solutions scale pretty much to any arbitrary company size
CircleSpokes 4y ago
The keys are OEM specific. Intel gives them to MSI so they can sign their firmware/BIOS updates. Clearly MSI didn't handle them well.
- emmelaich 4y ago
  So this is really an MSI key? Not Intel - even if Intel created it.
  - CircleSpokes 4y ago
    Intel gave it to MSI, but I may have been incorrect before. Apparently the keys was shared across multiple OEMs (at least that is how I read this below) >The leaked private keys affect Intel’s 11th, 12th, and 13th generation processors and were distributed to various OEMs, including Intel itself, Lenovo, and Supermicro.
    - Joker_vD 4y ago
      ...isn't such signing usually done the other way around? Intel would hold the signing keys, MSI (or any other OEM manufacturer) then sends (over a secure channel) their firmware to Intel, Intel signs it and sends the signature back.
      - CircleSpokes 4y ago
        I think that would make sense yes. It isn't clear to me why they would distribute the private keys to the OEMs (laziness?).
        Arnavion 4y ago
        The processor has to verify the signature, which means the public key needs to be embedded in the processor. It makes sense that the processor manufacturer creates the keys and distributes them. If it was the other way around, then a) fifty motherboard manufacturers would make their own keys and the processor would need space to embed fifty of them, and b) a new fifty-first motherboard manufacturer coming into the market would be unable to support any existing CPUs. It would also explain why the same key was used for signing multiple motherboard manufacturers' firmware. Why distribute the keys themselves instead of having some way for the motherboard manufacturers to upload an unsigned firmware and then download a signed one? That is probably laziness.

pmontra 4y ago

People know keys, people eventually leak keys. It always happened.

mynameisvlad 4y ago
The point is that you can't leak a key from a HSM.
- josefx 4y ago
  On the one hand that is the goal, on the other hand the applicable standard seems to be FIPS 140, which counts products with a flawless security history like OpenSSL amongst its long time adherents. In other words there is a non zero chance that the modules will just spit out the key if you even look at them funny.

29athrowaway 4y ago

Because security is a cost center and business people do not give a shit.

noizejoy 4y ago
It’s not just business people. Most humans seem to see security (and safety) as a burden, not as something enjoyable.
- userbinator 4y ago
  That's because people still generally value freedom over security, and that's a good thing.

XorNot 4y ago

If it's a master key you can't run the business risk of losing access to it.

dathinab 4y ago
you don't have that risk there are more then just one or two ways to not have that risk and still have HSK best many of this solutions scale pretty much to any arbitrary company size

CircleSpokes 4y ago

The keys are OEM specific. Intel gives them to MSI so they can sign their firmware/BIOS updates. Clearly MSI didn't handle them well.

emmelaich 4y ago
So this is really an MSI key? Not Intel - even if Intel created it.
- CircleSpokes 4y ago
  Intel gave it to MSI, but I may have been incorrect before. Apparently the keys was shared across multiple OEMs (at least that is how I read this below) >The leaked private keys affect Intel’s 11th, 12th, and 13th generation processors and were distributed to various OEMs, including Intel itself, Lenovo, and Supermicro.
  - Joker_vD 4y ago
    ...isn't such signing usually done the other way around? Intel would hold the signing keys, MSI (or any other OEM manufacturer) then sends (over a secure channel) their firmware to Intel, Intel signs it and sends the signature back.
    - CircleSpokes 4y ago
      I think that would make sense yes. It isn't clear to me why they would distribute the private keys to the OEMs (laziness?).
      - Arnavion 4y ago
        The processor has to verify the signature, which means the public key needs to be embedded in the processor. It makes sense that the processor manufacturer creates the keys and distributes them. If it was the other way around, then a) fifty motherboard manufacturers would make their own keys and the processor would need space to embed fifty of them, and b) a new fifty-first motherboard manufacturer coming into the market would be unable to support any existing CPUs. It would also explain why the same key was used for signing multiple motherboard manufacturers' firmware. Why distribute the keys themselves instead of having some way for the motherboard manufacturers to upload an unsigned firmware and then download a signed one? That is probably laziness.