Comment by stcredzero | Hacker News Reader

Comment by stcredzero | Hacker News Reader

In a more ideal world, all devices would have something like the Secure Enclave, but with the hardware and software open sourced. There would be a public process for vetting and verifying the design, as well as for verifying embodied instances. Ideally, it would be implemented in such a way that the security could be mathematically provable. This would let the public have the benefits of trusted execution, which they could then use to protect their information in the hands of corporations and governments.

This is the exact same asymmetry embodied in openness/privacy/surveillance. When governments and corporations have unfettered access to people's private information, this is very bad for human rights and an open democratic society. On the other hand, when individuals have open access to information from government organizations and corporations, this is generally good for human rights and an open democratic society.

Organizations using trusted execution technologies against individuals has been a disaster for individual rights. However, empowering individuals to use such technologies to protect them against corporations would have tremendous benefits for individuals.

It may be achievable to build a phone case ,that connects to the USB, and some storage and a touchpad that achieves something similar to the secure enclave(and the pass code),in a more open fashion.

It isn't possible to open source the hardware. If the secure enclave is really secure, it has parts that by definition cannot be examined or verified. So hardware specs can be open, but you'll never have any guarantee that's what you're getting because hardware is always a compiled blob.

Can you list some of these parts that, by your definition, cannot be examined or verified? If you're talking about physical security features to make decapping difficult, surely a high-res xray would be good enough to verify that the hardware is as specified without being able to read the contents of nonvolatile memory, and without compromising physical security.

Aren't the contents of NV memory pretty important though?

Anyway, it's just different than software. You can't sha sum your hardware to verify its what you expected.

I'm not sure, maybe an x-ray could see inside. Not unlike how binary blobs can be examined, but usually that's not considered open.

Manufacturers already use x-rays to make sure they're not installing counterfeit chips. Maybe we can look at the verification techniques used for US military procurement or by NASA.

I'd wager that we can have open hardware, and that its correct manufacture can be verified to a satisfactory degree by a combination of auditing and testing without running into limits of the laws of physics or inherent design requirements.

Question: could an x-ray device be made sensitive/high resolution enough to "read" whether a bit is flipped in silicon? (and extract the private key)

It's a tricky thing, and I fully admit that I have a limited understanding of the specific effects of x-rays on semiconductor devices. My understanding though is that you get higher resolution with higher-energy x-rays, and that as you increase the energy, you're more and more likely to damage the semiconductor (e.g. by inducing bit flips).

Here's some material from a flash memory manufacturer with more details: https://www.spansion.com/Support/Application%20Notes/X-ray_i...

Reply on news.ycombinator.com