3 ms·

> Note well: In the end-user version (not TKey Unlocked) the FPGA configuration is locked down. This means you cannot change the FPGA bitstream or read out the

> Note well: In the end-user version (not TKey Unlocked) the FPGA configuration is locked down. This means you cannot change the FPGA bitstream or read out the bitstream (or the Unique Device Secret, UDS) from the configuration memory, even if you break the case and insert it into a programmer board. That seems like it's only useful for "security" against the owner, rather than for any legitimate form of security.

AVincentInSpace 3y ago
How so?
- josephcsible 3y ago
  Consider a DRM system that does challenge/response against said secret so that only one computer at a time can use something. As the owner of this device, if I want to clone it, I should be able to.
  - its-summertime 3y ago
    You can buy an unlocked version and clone it, no?
  - charcircuit 3y ago
    But then the device could be used by 2 computers at once defeating the security. Another use case would be as a second factor of authentication. Making it impossible to clone is essential for a "something you own" factor.
FiloSottile 3y ago
That's the whole point of a TKey as a security device: the secret available to an application depends on both the device it's running on and the application, and can't be extracted, so you can do things like "sign a blob only if it follows these rules" and enforce it in hardware. If the device wasn't locked, you could just... change the rules. How is that not a legitimate form of security?
- josephcsible 3y ago
  If it's my device, then I should be able to change the rules.
  - kfreds 3y ago
    You're more than welcome to change the rules. Please read my other comments in this thread, and you'll hopefully find answers to your concerns. The TKey Unlocked gives you all the control you're asking for.
  - teruakohatu 3y ago
    If you can change the rules then someone else can also change the rules. And any ability to change the rules will greatly increase the surface area of attack.
ooterness 3y ago
Buy the unlocked version, program it and lock it down yourself.

AVincentInSpace 3y ago

How so?

josephcsible 3y ago
Consider a DRM system that does challenge/response against said secret so that only one computer at a time can use something. As the owner of this device, if I want to clone it, I should be able to.
- its-summertime 3y ago
  You can buy an unlocked version and clone it, no?
- charcircuit 3y ago
  But then the device could be used by 2 computers at once defeating the security. Another use case would be as a second factor of authentication. Making it impossible to clone is essential for a "something you own" factor.

FiloSottile 3y ago

That's the whole point of a TKey as a security device: the secret available to an application depends on both the device it's running on and the application, and can't be extracted, so you can do things like "sign a blob only if it follows these rules" and enforce it in hardware. If the device wasn't locked, you could just... change the rules. How is that not a legitimate form of security?

josephcsible 3y ago
If it's my device, then I should be able to change the rules.
- kfreds 3y ago
  You're more than welcome to change the rules. Please read my other comments in this thread, and you'll hopefully find answers to your concerns. The TKey Unlocked gives you all the control you're asking for.
- teruakohatu 3y ago
  If you can change the rules then someone else can also change the rules. And any ability to change the rules will greatly increase the surface area of attack.

ooterness 3y ago

Buy the unlocked version, program it and lock it down yourself.