4 ms·

We're aiming to push things in the other direction with OpenTitan: https://github.com/lowRISC/opentitan/ https://github.com/lowRISC/opentitan/ It's an Open Sil

We're aiming to push things in the other direction with OpenTitan: https://github.com/lowRISC/opentitan/ https://github.com/lowRISC/opentitan/ It's an Open Silicon root of trust, all RTL (the actual hardware design in SystemVerilog), firmware, documentation and verification environment is open source and in the repository I just linked. We're closing in on our first discrete chip (details here https://opensource.googleblog.com/2023/06/opentitan-rtl-freeze.html.html https://opensource.googleblog.com/2023/06/opentitan-rtl-free... and https://lowrisc.org/blog/2023/06/opentitans-rtl-freeze-leveraging-transparency-to-create-trustworthy-computing/ https://lowrisc.org/blog/2023/06/opentitans-rtl-freeze-lever...) and have lots more in the pipeline (our project director Dom Rizzo gave a keynote at the Barcelona RISC-V Europe summit recently with some details, sadly not available on video yet). The hope is this will be a real proof point of the value of open source in hardware and, if as successful as we like it to be, can push the industry from a closed by default to people having to justify why they're not using open technology.

tiffanyg 3y ago
I like this approach, speaking from a very general perspective (very uneducated regarding hardware, comparatively). Absolutely brings back memories of the 90s and arguments regarding open vs closed source and "security through obscurity". Security through obscurity doesn't work, ultimately. When economic stakes are / were lower, it CAN have benefits. At this point, I suspect it's likely that more eyes and openness is better. That said, I do think that the best solution is likely to be based in a mixture of approaches, much as has been pursued (to my knowledge) and developed over time already. However, personally, I'm a big fan of "formal methods" and seeing more real-world deployment of such methods. In practice, as has been done that I've seen, you start with small & critical subsystems, trying to design for "parsimony" - making formal methods and everything else more realistic / practical (e.g., "microkernels", everyone's favorite 'solution' since the 80s, at least). But, it's all very challenging because then it has to be balanced against performance, cost, etc. Not sure this comment adds much, here - again, not an area I have much direct knowledge or experience in - but, your comment did bring some analogous areas and work I'm more familiar with to mind.
hlandau 3y ago
Can you explain how the root of trust is configured? Is it efuses or some sort of onboard mutable nonvolatile storage? If I buy a system with one of these chips in, am I likely to be able to set my own root of trust, or will the OEM have irreversibly set the root of trust to their own key?
- mkj 3y ago
  It looks like the chips themselves should support change of ownership. Whether an OEM ships them in an unlocked (transferrable) state is up to them. https://opentitan.org/book/doc/security/specs/ownership_transfer/#unlock-ownership https://opentitan.org/book/doc/security/specs/ownership_tran...
genmud 3y ago
If you ever need someone to test your stuff when it makes it into the physical world, would love to help :) I really want to see an open motor control peripheral that could be used in robotics or UAVs, it's amazing how ubiquitous they are, yet rarely are very integrated like other controllers.

tiffanyg 3y ago

I like this approach, speaking from a very general perspective (very uneducated regarding hardware, comparatively). Absolutely brings back memories of the 90s and arguments regarding open vs closed source and "security through obscurity". Security through obscurity doesn't work, ultimately. When economic stakes are / were lower, it CAN have benefits. At this point, I suspect it's likely that more eyes and openness is better. That said, I do think that the best solution is likely to be based in a mixture of approaches, much as has been pursued (to my knowledge) and developed over time already. However, personally, I'm a big fan of "formal methods" and seeing more real-world deployment of such methods. In practice, as has been done that I've seen, you start with small & critical subsystems, trying to design for "parsimony" - making formal methods and everything else more realistic / practical (e.g., "microkernels", everyone's favorite 'solution' since the 80s, at least). But, it's all very challenging because then it has to be balanced against performance, cost, etc. Not sure this comment adds much, here - again, not an area I have much direct knowledge or experience in - but, your comment did bring some analogous areas and work I'm more familiar with to mind.

hlandau 3y ago

Can you explain how the root of trust is configured? Is it efuses or some sort of onboard mutable nonvolatile storage? If I buy a system with one of these chips in, am I likely to be able to set my own root of trust, or will the OEM have irreversibly set the root of trust to their own key?

mkj 3y ago
It looks like the chips themselves should support change of ownership. Whether an OEM ships them in an unlocked (transferrable) state is up to them. https://opentitan.org/book/doc/security/specs/ownership_transfer/#unlock-ownership https://opentitan.org/book/doc/security/specs/ownership_tran...

genmud 3y ago

If you ever need someone to test your stuff when it makes it into the physical world, would love to help :) I really want to see an open motor control peripheral that could be used in robotics or UAVs, it's amazing how ubiquitous they are, yet rarely are very integrated like other controllers.