5 ms·
How is it unreasonable for open-source OS developers to be concerned about closed-source blobs in cryptographic components?
by uvdiv 14y ago
How is it unreasonable for open-source OS developers to be concerned about closed-source blobs in cryptographic components?
- rwg 14y agoAlso, I don't remember anyone getting publicly bent out of shape about including AES-NI support in Linux's CryptoAPI. (I'm unsure why people would think Intel would backdoor RdRand but not the AES-NI instructions.)
- dchest 14y agoThe output of AES-NI is easy to verify. You can't verify random numbers generator.
- rwg 14y agoThe entire CPU is "closed source." If you can't trust the CPU, then it's game over for everything you're doing on the CPU.
- zurn 14y agoTrust isn't binary. Backdooring or exploitably bungling the deterministic parts of the CPU without getting caught is much harder than doing the same for the RNG part. Black box RNG's are notoriously hard to evaluate.