4 ms·

Open-source designs (for software or hardware) aren't a complete solution. You need to regularly audit the end-result, lest the compiler/fab add unwanted nastie

Open-source designs (for software or hardware) aren't a complete solution. You need to regularly audit the end-result, lest the compiler/fab add unwanted nasties to your design.

api 12y ago
Nobody has time to do that. Ultimately you have to trust someone, thus this is more a political problem than a technical one.
- dllthomas 12y ago
  You have to trust someone, but we can move in either direction along the spectrum from "I have to trust all of these many people and if any of them is untrustworthy I'm boned" to "I have to trust some of these many people and if all of them are untrustworthy I'm boned". There are both technological and political elements to any solution here.
lazyjones 12y ago
We might want to move to mostly FPGA-based or similar reconfigurable systems, where what we perceive as hardware is more easily audited. OR we might want to go back to shopping anonymously "offline", hoping that the NSA will not bother backdooring every device on the market.
- captainmojo 12y ago
  https://news.ycombinator.com/item?id=6350906 https://news.ycombinator.com/item?id=6350906
- bri3d 12y ago
  What bitstream is the FPGA currently configured with? The one in flash? Really? What's to say the bitstream made it to the FPGA correctly? Can you tell? What if it reconfigured itself [1]? There's some research [2] into using authenticated, encrypted bitstreams, but even if the implementation matches the theory (and after all, it's crypto, we know how that goes...) this only reaches the same level of security as a fixed-configuration ASIC, since FPGAs are vulnerable to the same nefarious fab attacks as ASICs. 1: http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_final.pdf http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_f... 2: http://www.saardrimer.com/sd410/papers/bsauth.pdf http://www.saardrimer.com/sd410/papers/bsauth.pdf
  - makomk 12y ago
    FPGA bitstreams are big, sometimes even big enough that you couldn't fit another bitstream in hardware anywhere. What's more, making even a small change to the bitstream and re-synthesising tends to completely change how the design is laid out in hardware - so launching an attack that targets a specific bitstream, like most of the obvious nefarious-fab attacks, isn't much good.
gss44 12y ago
Regularly? Almost any major software/hardware project changes iteratively over time. You just have to audit the changes between major releases, which for firmware, are typically very irregular. Also, just transitioning to a more open process with an open codebase has the effect of "keeping them honest". Once the code is out there, they have no way of knowing who might be scrutinizing it and have no chance to retroactively cover something up. This is why it's such a big deal when companies make a commitment to openness (the real kind -- not the buzzword kind). It's a statement of being willing to forego most of the dirty tactics that being closed source allows and to playing a fair(er) game.
superuser2 12y ago
This doesn't do anything. NSA is intercepting specific shipments. Unless you happen to be a target of the same program, what you're auditing is not the same as what the target received.

Open-source designs (for software or hardware) aren't a complete solution. You need to regularly audit the end-result, lest the compiler/fab add unwanted nasties to your design.

api 12y ago

Nobody has time to do that. Ultimately you have to trust someone, thus this is more a political problem than a technical one.

dllthomas 12y ago
You have to trust someone, but we can move in either direction along the spectrum from "I have to trust all of these many people and if any of them is untrustworthy I'm boned" to "I have to trust some of these many people and if all of them are untrustworthy I'm boned". There are both technological and political elements to any solution here.

lazyjones 12y ago

We might want to move to mostly FPGA-based or similar reconfigurable systems, where what we perceive as hardware is more easily audited. OR we might want to go back to shopping anonymously "offline", hoping that the NSA will not bother backdooring every device on the market.

captainmojo 12y ago
https://news.ycombinator.com/item?id=6350906 https://news.ycombinator.com/item?id=6350906
bri3d 12y ago
What bitstream is the FPGA currently configured with? The one in flash? Really? What's to say the bitstream made it to the FPGA correctly? Can you tell? What if it reconfigured itself [1]? There's some research [2] into using authenticated, encrypted bitstreams, but even if the implementation matches the theory (and after all, it's crypto, we know how that goes...) this only reaches the same level of security as a fixed-configuration ASIC, since FPGAs are vulnerable to the same nefarious fab attacks as ASICs. 1: http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_final.pdf http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_f... 2: http://www.saardrimer.com/sd410/papers/bsauth.pdf http://www.saardrimer.com/sd410/papers/bsauth.pdf
- makomk 12y ago
  FPGA bitstreams are big, sometimes even big enough that you couldn't fit another bitstream in hardware anywhere. What's more, making even a small change to the bitstream and re-synthesising tends to completely change how the design is laid out in hardware - so launching an attack that targets a specific bitstream, like most of the obvious nefarious-fab attacks, isn't much good.

gss44 12y ago

Regularly? Almost any major software/hardware project changes iteratively over time. You just have to audit the changes between major releases, which for firmware, are typically very irregular. Also, just transitioning to a more open process with an open codebase has the effect of "keeping them honest". Once the code is out there, they have no way of knowing who might be scrutinizing it and have no chance to retroactively cover something up. This is why it's such a big deal when companies make a commitment to openness (the real kind -- not the buzzword kind). It's a statement of being willing to forego most of the dirty tactics that being closed source allows and to playing a fair(er) game.

superuser2 12y ago

This doesn't do anything. NSA is intercepting specific shipments. Unless you happen to be a target of the same program, what you're auditing is not the same as what the target received.