The PSP is already quite long in the tooth. I think AMD will switch to ARM's recently announced "SecurCore" soon, just like Qualcomm did for the Snapdragon 845:

https://developer.arm.com/products/processors/cortex-m/sc300...

That "processor" has been out for at least ten years.

It's not related to Secure Boot, no, so there's no requirement for physical access.

I think Intel's ME is much more complex than AMD's PSP. Does anyone know if AMD's PSP has a full network stack and the ability to interact with network hardware independent of the main CPU's OS?

Yes, AMD's PSP runs a full OS which was made by Trustonic.

It must feel weird to create an operating system that runs on a CPU inside a bigger CPU.

Technically if you count virtual machines as CPUs then every piece of Javascript etc. code runs in a CPU inside a CPU :P

Trustonic is about as trustworthy a name as "Safecorp" or something similar. The name itself is just one big red flag.

They are probably the largest TEE* supplier AFIK even bigger than Intel; they are pretty much the Java of the TEE world.

It’s a joint venture between ARM, Gemalto and a few other companies iirc.

*Trusted Execution Environment

Ahhh, okay. Thanks for the clarification!

I had read somewhere that AMD PSP does not have Internet access.

It does, DASH is also arguably much less secure than Intel's RMT.

Hmm, I did not know this. Good to know!

Is there a documentation of what its capabilities are? I can't find anything specific about it.

Of the remote management? Only this https://developer.amd.com/tools-for-dmtf-dash/

AMD hasn't really had any hardware for the enterprise for a long time so they are quite behind on many things.

This is their free remote admin tool : https://community.amd.com/community/devgurus/dmtf-dash/blog/...

It can basically do quite a few things, change firmware, boot an image, redirect USB input and likely quite a few of other undocumented things.

With Ryzen Pro launching soon I guess AMD would release a new suite of remote management software.

Thank you.

TPM's are supposed to be resistant to physical attacks.

With this flaw, someone can just stick a bootable USB stick in your computer to mirror the LUKS/bitlocker disk drive and get access to the keys in the TPM which protect that drive.

For discrete TPMs the specification explicitly says that they are not required to be resistant to physical attacks (probably because that would require specifying what kinds of attacks it is supposed to be resistant to).