AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a Cost

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by 3np on Tuesday September 08, 2020 @10:31PM (#24416246)

Wouldn’t it make more sense to blow the motherboard rather than the CPU? A compromised CPU without anything connected is pretty useless at boot. The motherboard is what’s connected to all the good stuff.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by 0zymandiass on Tuesday September 08, 2020 @10:50PM (#24416420)

The CPU isn't what's compromised - this is protecting against a compromised motherboard

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by soneil on Tuesday September 08, 2020 @10:53PM (#24416451)

I think that’s the chicken & egg. If the motherboard was responsible for this, you’re trusting the firmware to validate itself. So this moves the validation a level lower.

It’s an interesting problem. The solution is valid, but it’s unfortunately permanent.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by im3w1l on Wednesday September 09, 2020 @05:30AM (#24419100)

You could have a small rom firmware validating a larger ugradable firmware.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by bayindirh on Wednesday September 09, 2020 @02:08AM (#24417752)

However, the root of trust is embedded to the CPU. So, you can't hammer the CPU on another board for keys.

Also, we sometimes lose the CPU rather than the board. As the CPUs become more complex, their probability to fail has risen.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by 3np on Wednesday September 09, 2020 @06:35AM (#24419544)

> However, the root of trust is embedded to the CPU. So, you can't hammer the CPU on another board for keys.

I guess that's the key point here.

[ Parent | on HN ]