Aren't data diodes already a regulatory requirement for any connection between avionics and the IFE?

I guess they are a regulatory requirement because all of the modern aircraft have to request special conditions form FAA and EASA to justify why they do not comply with these requirements.

For example for the Airbus A350;:

> The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. These proposed special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards.

[1] https://www.federalregister.gov/documents/2013/12/17/2013-29...

No clue, but Boeing’s weasel-worded statement sounds awfully like they’re trying to defend a software-only solution.

Not just that. They have to be designed securely so they work in face of both logical and physical attacks. Security-focused diodes are supposed to include things such as emanation attacks. They're not cheap. Even the cheaper setups would be better than software-based security, though.

Does any of that actually matter in a realistic threat model in an airplane? The integrity of the critical systems matters, but there shouldn’t be any secrecy concerns. An attacker learning the full state of the avionics computer would be of little value. Similarly, a side channel from the entertainment system to a critical system shouldn’t matter unless the critical system is already compromised, since the critical system won’t be listening to the side channel.