5 ms·
Seems relevant: For more context: we have historically required the crypto instructions because 1. We make heavy use of sha256 in blobfs, where such content-h
by jefftk 3y ago
Seems relevant:
For more context: we have historically required the crypto instructions because
1. We make heavy use of sha256 in blobfs, where such content-hashing is on the critical path of loading all binaries, and we believe that in the absence of hardware acceleration, product owners will likely find that their performance requirements are difficult to attain and may seek to resolve those issues by compromising core security invariants, which we do not wish to encourage
2. For protecting mutable storage, both reads and writes go through AES-XTS, either in zxcrypt or fxfs-crypt. For similar reasons, we want AES instructions to be accelerated, so that protection of user data is not something that we are motivated to compromise for performance reasons.
3. In any product, we expect to do TLS for a variety of purposes (software updates, time sync, communications with servers, etc.), and don't want poor TLS performance to be a reason that people are later motivated to avoid TLS/use weak ciphersuites/etc.
Since we do not want product owners to be motivated to disable fairly fundamental security features of the system, we have endeavored to ensure that the hardware baseline is likely to adequately support performance requirements, including through the requirement of the ARM crypto instructions on such boards.
-- https://fuchsia-review.googlesource.com/c/fuchsia/+/808670?tab=comments https://fuchsia-review.googlesource.com/c/fuchsia/+/808670?t... marking the relevant CPU as not supporting crypto instructions.
- telotortium 3y agoWhy wouldn't they catch this before they started work on porting this device to Fuchsia? Why isn't this a problem with the existing OS (Android? ChromeOS?)?
- MBCook 3y agoPerhaps they didn’t think the impact was going to be as bad as it was and it turned out it just wasn’t possible to meet their standards as they had hoped w/o requiring crypto hardware. Or, perhaps, they simply changed their minimum security standards and had to raise requirements as a result.
- pclmulqdq 3y agoSecurity people very often underestimate the performance impact of encryption (especially on embedded devices), so the former would not be surprising to me. Without acceleration, AES hurts and is incredibly hard to implement without opening up side-channel attacks. SHA is also very slow without acceleration. Both have simple, more modern alternatives that are a lot faster on embedded (ChaCha and Blake2 respectively). Of course, they are also often unwilling to compromise on their chosen security practices to adapt to the situation, even if that just means switching to lightweight/embedded-friendly cryptography algorithms with similar security levels.
- mobilio 3y agoEven Raspberry Pi (all of them!) doesn't have AES accelerated instructions.
- civilitty 3y agoThat’s not a big deal on a multi-core 1ghz processor. Much bigger deal on a single core 200mhz microcontroller that doesn’t have branch prediction or any of those fun optimizations.
- Symmetry 3y agoI know you're pointing at the general class of hardware performance enhancements including branch prediction, hardware prefetching, superscaler execution, pipelining, etc. But out of all of them, if you get a speedup for any advanced branch prediction beyond just always assuming branches are taken then I'd be very worried your cryptographic algorithm is broken.
- eyegor 3y agoFyi, blake3 was released in 2019 and should probably be used over blake2 unless you have some strong reason not to. It's basically a reimplementation of blake2 with performance tweaks. https://github.com/BLAKE3-team/BLAKE3 https://github.com/BLAKE3-team/BLAKE3 If you need a non cryptographic hash, the xxhash family is crazy fast. https://github.com/Cyan4973/xxHash https://github.com/Cyan4973/xxHash
- jefftk 3y ago> Why wouldn't they catch this before they started work on porting this device to Fuchsia? Perhaps because the CPU was erroneously marked as supporting those instructions? > Why isn't this a problem with the existing OS (Android? ChromeOS?)? I'm not very informed here, but I think the existing OS doesn't do (1) or (2)?
- CameronNemo 3y agoWhere did amlogic advertise that their smart speaker SoC had the crypto extensions?
- prmoustache 3y agoThis is just speculation that they didn't catch this before. Maybe they weren't yet decided on lowering their security stance for these specific devices to one similar to the existing OS or skipping these devices. Maybe management was pushing for them to find a solution either way. We can speculate in a lot of different ways.
- astrange 3y ago> For protecting mutable storage, both reads and writes go through AES-XTS, either in zxcrypt or fxfs-crypt. Fuschia uses block-based disk encryption? I think iOS had more secure file-based encryption in 2010. (It looks like fxfs-crypt has better options than AES-XTS block encryption though.)