HackerTube

36C3 - Open Source is Insufficient to Solve Trust Problems in Hardware

media.ccc.de2 HN recommenders · 2020–2023
13K views · talk · evergreen · Uploaded 2019-12-27

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

HN commenters point to it whenever the question is how far hardware can be trusted, including FPGAs, supply chain attacks and firmware TPMs.

Security & hackingSemiconductors & chip manufacturingHacker culture & free software

Watch on YouTube

4 comments from Hacker News

@Confiks2020 · in “OpenTitan RTL Synthesis with Yosys”

Here's an excellent talk that addresses your question: Open Source is Insufficient to Solve Trust Problems in Hardware [1]. [1] [VIDEO]

Strongly recommendsView on HN
@Confiks2020 · in “Bunnie's Precursor Crowdfunding Begins”

Here's an excellent talk that addresses your question: Open Source is Insufficient to Solve Trust Problems in Hardware [1]. [1] [VIDEO]

Strongly recommendsView on HN
@skinner9272021 · in “U.S. telecoms are going to start physically removing Huawei gear”

There’s really no way to ever be 100% sure of hardware. Sure we could use FPGAs for all hardware and then the hardware “source” is software, but who makes the FPGAs? There’s techniques even under X-ray to mask a rogue chip. [VIDEO]

CitesView on HN
@kfreds2023 · in “AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defeating Disk Encryption”

As I'm sure you're aware FPGAs are nice because they can complicate things for an attacker in the physical supply chain. Andrew "bunnie" Huang did an excellent talk on the subject: [VIDEO]

RecommendsView on HN