Re:Technical feasibility of decrypting https by replacing th...
by captainmuon on Sunday July 14, 2013 @01:34PM
(#6041486)
Well, people use Intel chips because they don't really have a choice. I assume if Intel cooperates with the NSA, then so does AMD, and then you don't really have many more options.
Yes, manufacturers could plant all sorts of backdoors in your CPU (and other hardware), and they probably have. Still, I can reasonably assume that if I buy consumer hardware in a regular store, run secure and open source software, and am careful about my network, I'll be reasonably safe. Now, Intel introduces RdRand as a black box RNG. I'm not saying there's anything wrong with it, but if the NSA or whoever wanted to plant an inconspicuous weakness on millions of computers, this would be a nice way. I guess they could also do it with only a handfull of engineers at Intel knowing about it, as opposed to some other attacks that involve the whole processor.
Re:Technical feasibility of decrypting https by replacing th...
by hannibal5 on Sunday July 14, 2013 @12:34PM
(#6041308)
The difference is that planted weakness in RdRand enables mass surveillance by weakening cryptographic algorithms. Other possible backdoors just make subject that are specially targeted weaker.
It kind of sucks that RdRand is hard to verify as a user but it's no smoking gun either so it's not a great sell if you are trying to warn other people about the risks of backdoored hardware too.