3 ms·

I'm really surprised that Intel seems to have done a good job and really uses RSA signatures and not some insecure design.

by atesti 14y ago

wladimir 14y ago
Indeed, it's surprising. I wonder if it has dedicated circuitry to do the verification, or that it somehow executes a verification program on the processor itself. I suppose it's the second because the first sounds really expensive.
- lucb1e 14y ago
  > The exact cycle value will vary significantly between different types of hardware (older hardware was observed to take significantly more cycles) This makes me think it uses the CPU itself. Microcode updates are not an everyday thing and don't need to be fast, they have no reason to update the circuitry for that. They still might have changed it, but this makes it seems lightly less likely.
  - acallan 14y ago
    This isn't true. Ucode is updated every time you reset, and on each CPU. At the fab, the release ucode is burned into the design. But rarely does this last through the lifetime of a stepping. In fact, one of the main reasons why BIOS/EFI exists is to update microcode, and this is usually on one of the first things it does. From the Intel SDM, Vol III, 9.11.6.1 "The effects of a loaded update are cleared from the processor upon a hard reset. Therefore, each time a hard reset is asserted during the BIOS POST, the update must be reloaded on all processors that observed the reset. The effects of a loaded update are, however, maintained across a processor INIT. There are no side effects caused by loading an update into a processor multiple times." EDIT: I realize you were talking about it being a daily occurrence, and few of us reboot daily. But still, OEMs and most customers don't want a long boot time. Also note that in certain power states (deep sleep), the CPU is off, and waking up your laptop actually will cause a ucode load.
    - cfallin 14y ago
      I think the discussion here is missing the fact that "long boot time" is on the order of milliseconds. From the article: the average time for a ucode update on the test machine was 489k cycles, which at 2.53GHz is 193 microseconds. I hardly count that as a large part of the boot time...
acallan 14y ago
A couple of things (I work for Intel, and do not speak for them): -A ucode hack would be the ULTIMATE backdoor -A ucode hack could damage or destroy (melt) the part. Think of things like thermal diode trim values, voltage, etc. Intel had a billion-dollar lesson with recalls in the past, and the learning wasn't lost.

I'm really surprised that Intel seems to have done a good job and really uses RSA signatures and not some insecure design.

by atesti 14y ago

I'm really surprised that Intel seems to have done a good job and really uses RSA signatures and not some insecure design.

wladimir 14y ago

Indeed, it's surprising. I wonder if it has dedicated circuitry to do the verification, or that it somehow executes a verification program on the processor itself. I suppose it's the second because the first sounds really expensive.

lucb1e 14y ago
> The exact cycle value will vary significantly between different types of hardware (older hardware was observed to take significantly more cycles) This makes me think it uses the CPU itself. Microcode updates are not an everyday thing and don't need to be fast, they have no reason to update the circuitry for that. They still might have changed it, but this makes it seems lightly less likely.
- acallan 14y ago
  This isn't true. Ucode is updated every time you reset, and on each CPU. At the fab, the release ucode is burned into the design. But rarely does this last through the lifetime of a stepping. In fact, one of the main reasons why BIOS/EFI exists is to update microcode, and this is usually on one of the first things it does. From the Intel SDM, Vol III, 9.11.6.1 "The effects of a loaded update are cleared from the processor upon a hard reset. Therefore, each time a hard reset is asserted during the BIOS POST, the update must be reloaded on all processors that observed the reset. The effects of a loaded update are, however, maintained across a processor INIT. There are no side effects caused by loading an update into a processor multiple times." EDIT: I realize you were talking about it being a daily occurrence, and few of us reboot daily. But still, OEMs and most customers don't want a long boot time. Also note that in certain power states (deep sleep), the CPU is off, and waking up your laptop actually will cause a ucode load.
  - cfallin 14y ago
    I think the discussion here is missing the fact that "long boot time" is on the order of milliseconds. From the article: the average time for a ucode update on the test machine was 489k cycles, which at 2.53GHz is 193 microseconds. I hardly count that as a large part of the boot time...

acallan 14y ago

A couple of things (I work for Intel, and do not speak for them): -A ucode hack would be the ULTIMATE backdoor -A ucode hack could damage or destroy (melt) the part. Think of things like thermal diode trim values, voltage, etc. Intel had a billion-dollar lesson with recalls in the past, and the learning wasn't lost.