3 ms·

> at the end of the day any hardware of sufficient complexity is not practical to verify, whether open or closed. Even if we published the complete mask set for

> at the end of the day any hardware of sufficient complexity is not practical to verify, whether open or closed. Even if we published the complete mask set for a modern billion-transistor CPU, this “source code” is meaningless without a practical method to verify an equivalence between the mask set and the chip in your possession down to a near-atomic level without simultaneously destroying the CPU. Sounds about right to me. And if you can't trust the hardware, it goes without saying that you can't trust the software running on it. They go on to explain/promote their "Betrusted" verifiable hardware approach, which is good and all, but ultimately I feel suffers from the same fundamental problem (hard to verify the actual hardware you're using without destroying it). Some mitigation strategies are offered, though. I'm glad they aren't over-promising, and are clear that these are steps in the right direction rather than full solutions. I think most people (myself included) don't have the technical expertise to know if a given verification is valid, either. Such people would need to offload that task to someone else — someone they must trust, yet again. The notion of trust is so profound and slippery, even without involving computers. It's fascinating to see it play out in a more rigorously-observed fashion through modern technology.

xw3098 3y ago
Assume this was true. Now, for the sake of argument, say someone makes a mask with an error. How would you identify where in the manufacturing system the fault lies?
guidoism 3y ago
I wonder if you only need to be able to verify a small portion. The stuff that deals with passwords and encryption and transferring money between bank accounts and sending and editing secure messages. I’m not sure I care if the code that helps me view 3d graphics has been compromised or not.
- HPsquared 3y ago
  How do you see the secure messages though? They need to go through the graphics stack, some portion thereof at least.
hx8 3y ago
I would be very happy with a method of verifying hardware even if it included destruction. I think my biggest risk is that the hardware is compromised before I become its owner. I would feel comfortable buying 5 of everything, picking one at random to keep and verify/destroying the other 4. Depending on my results of this process, the cost of the hardware, and the sensitivity of the applications I could see my increasing the number of items I would need to purchase. I can also see "verification" companies that test a statistically significant sample of devices before reselling them to individuals.

xw3098 3y ago

Assume this was true. Now, for the sake of argument, say someone makes a mask with an error. How would you identify where in the manufacturing system the fault lies?

guidoism 3y ago

I wonder if you only need to be able to verify a small portion. The stuff that deals with passwords and encryption and transferring money between bank accounts and sending and editing secure messages. I’m not sure I care if the code that helps me view 3d graphics has been compromised or not.

HPsquared 3y ago
How do you see the secure messages though? They need to go through the graphics stack, some portion thereof at least.

hx8 3y ago

I would be very happy with a method of verifying hardware even if it included destruction. I think my biggest risk is that the hardware is compromised before I become its owner. I would feel comfortable buying 5 of everything, picking one at random to keep and verify/destroying the other 4. Depending on my results of this process, the cost of the hardware, and the sensitivity of the applications I could see my increasing the number of items I would need to purchase. I can also see "verification" companies that test a statistically significant sample of devices before reselling them to individuals.