4 ms·

If the CPU is compromised then you've already lost.

deleted 13y ago
[deleted]
tlb 13y ago
Sure, but the CPU has to perform correctly on general-purpose computations so it's not too likely that, for example, the multiplication instructions occasionally give wrong results. Detecting cryptographic code executing in the CPU and subverting it is hard in general, but quite easy if you have a special instruction used only for the purpose.
- jerf 13y ago
  You've overshot, though. The solution to what you're describing isn't to remove RdRand from the Linux kernel, it's to entirely give up. This is not a defense of the change.org request.
- tptacek 13y ago
  There are multiple special-purpose security instructions; AESENC, for instance, or even PCLMULQDQ, which was added to speed up GCM. Which ones should we keep and which ones should we jettison?
  - makomk 13y ago
    Since AESENC and PCLMULQDQ are meant to be deterministic - including their timing - it's rather harder for Intel to subvert them in a way that's not detectable than something like RDRAND.
devx 13y ago
If the CPU is compromised then we should try to find out about it. We might not all be cryptography experts like Linus is implying he is, but he saying there's no way the CPU could be compromised and use the backdoor against Linux? If not, then he should invite more scrutiny, not less. From what I understand it would be very hard to even know if the CPU is compromised, so why is he so absolutist about it then, if it's impossible for him to prove with absolute 100 percent certainty that it's false? As the post at the top says: trust no one.
- conductor 13y ago
  > If the CPU is compromised then we should try to find out about it. This is a copy-paste of my comment from an older thread [0]: http://www.xakep.ru/post/58104/ http://www.xakep.ru/post/58104/ (use Google Translate) TL;DR The author has found an undeclared software module (backdoor?) working as a hyper-visor in the System Management Block chip on the South Bridge working with Intel CPU with VT virtualization technology. [0] - https://news.ycombinator.com/item?id=4462782 https://news.ycombinator.com/item?id=4462782
bcoates 13y ago
Buy CPUs from two (or n) different vendors and run a user space lockstep execution virtual machine between them. Unless all vendors are compromised in exactly the same way, the output will fail to verify. Of course, this would prevent you from using RdRand as your VM implementation will only be able to call on deterministic instructions...

deleted 13y ago

[deleted]

tlb 13y ago

Sure, but the CPU has to perform correctly on general-purpose computations so it's not too likely that, for example, the multiplication instructions occasionally give wrong results. Detecting cryptographic code executing in the CPU and subverting it is hard in general, but quite easy if you have a special instruction used only for the purpose.

jerf 13y ago
You've overshot, though. The solution to what you're describing isn't to remove RdRand from the Linux kernel, it's to entirely give up. This is not a defense of the change.org request.
tptacek 13y ago
There are multiple special-purpose security instructions; AESENC, for instance, or even PCLMULQDQ, which was added to speed up GCM. Which ones should we keep and which ones should we jettison?
- makomk 13y ago
  Since AESENC and PCLMULQDQ are meant to be deterministic - including their timing - it's rather harder for Intel to subvert them in a way that's not detectable than something like RDRAND.

devx 13y ago

If the CPU is compromised then we should try to find out about it. We might not all be cryptography experts like Linus is implying he is, but he saying there's no way the CPU could be compromised and use the backdoor against Linux? If not, then he should invite more scrutiny, not less. From what I understand it would be very hard to even know if the CPU is compromised, so why is he so absolutist about it then, if it's impossible for him to prove with absolute 100 percent certainty that it's false? As the post at the top says: trust no one.

conductor 13y ago
> If the CPU is compromised then we should try to find out about it. This is a copy-paste of my comment from an older thread [0]: http://www.xakep.ru/post/58104/ http://www.xakep.ru/post/58104/ (use Google Translate) TL;DR The author has found an undeclared software module (backdoor?) working as a hyper-visor in the System Management Block chip on the South Bridge working with Intel CPU with VT virtualization technology. [0] - https://news.ycombinator.com/item?id=4462782 https://news.ycombinator.com/item?id=4462782

bcoates 13y ago

Buy CPUs from two (or n) different vendors and run a user space lockstep execution virtual machine between them. Unless all vendors are compromised in exactly the same way, the output will fail to verify. Of course, this would prevent you from using RdRand as your VM implementation will only be able to call on deterministic instructions...