Show HN: The SC4-HSM, a fully open USB hardware secure module

Re:Show HN: The SC4-HSM, a fully open USB hardware secure mo... by pjc50 on Friday July 08, 2016 @04:37AM (#12054252)

Are RISCV devices actually available at all?

I'm not too worried about backdoors in microcontrollers, they're too small to hide much.

Are the designs of this chip at least available, and audit-able

I'm not aware of any processors you can buy from current production that meet this criterion (because it would involve complete exposure of that company's IP). I suppose the fully reverse-engineered 6502 meets it.

[ Parent | on HN ]

Re:Show HN: The SC4-HSM, a fully open USB hardware secure mo... by kabdib on Friday July 08, 2016 @09:07AM (#12055188)

> I'm not too worried about backdoors in microcontrollers, they're too small to hide much.

You can hide a LOT on a chip, though for embedded systems the attacks are not likely to be generic, or scale.

If I was a spook agency, I'd definitely try to compromise USB handling, at a low level. Most controllers I know of use DMA, so it's likely that sneaking in a few hundred gates would open up a whole SOC. The USB controllers are just libraries that people buy; I don't know how closely they are audited by customers.

Hook that up to a compromised PC (read about system management CPUs...) and that's the ball game.

Silicon is pretty opaque.

[ Parent | on HN ]

Re:Show HN: The SC4-HSM, a fully open USB hardware secure mo... by frederikvs on Friday July 08, 2016 @05:15AM (#12054367)

> I'm not too worried about backdoors in microcontrollers, they're too small to hide much.

Have you read the article "A2: Analog Malicious Hardware" [1]? You really don't need much space to insert a backdoor in silicon.

[1] http://ieee-security.org/TC/SP2016/papers/0824a018.pdf

[ Parent | on HN ]