7 ms·

Excellent work. I completely agree that today the easiest option to develop safe hardware is using FPGAs. Two things to look forward: 1. Usage of open sour

by klhugo 7y ago

Excellent work. I completely agree that today the easiest option to develop safe hardware is using FPGAs. Two things to look forward: 1. Usage of open source FPGA synthesis and implementation tools 2. Usage of open source FPGA chips :) I've already seen some traction happening for open source FPGA tools, but open source FPGA chips are only in my head (as far as I know). I'm a chip designer myself, and for years I have been thinking on kickstarting something to pay for a tapeout of an open source FPGA. If anyone is interested let me know, I live in Ontario/Canada.

jayjader 7y ago
I've seen things like this (https://www.crowdsupply.com/tinyfpga/tinyfpga-bx https://www.crowdsupply.com/tinyfpga/tinyfpga-bx) crop up on CrowdSupply. Not sure how close it is to what you have in mind.
jacquesm 7y ago
How will you know the mask of your FPGA isn't changed? I think that the idea behind all of this is sound but that at some point we will have to accept that there always will be some remnant of insecurity unless you are willing to create your own fab or build your CPU up out of discrete transistors which can be (1) exhaustively tested and (2) are too simple to contain anything nefarious given that there is no way to know where in a circuit that transistor will end up.
- klhugo 7y ago
  A couple things: 1. FPGAs are easier to verify cause they are regular structures. 2. How do you insert a backdoor in an FPGA at the supply chain if you don't know what is the exact logic that is going to be uploaded?
  - jacquesm 7y ago
    > How do you insert a backdoor in an FPGA at the supply chain if you don't know what is the exact logic that is going to be uploaded? Popularity of certain open core designs might be one way to gain advance knowledge of how an FPGA might be used. That suggests an interesting option: to scramble the input to an FPGA in such a way that the device will still work but that it is even more unpredictable how its internal connections will be used (otherwise you could take a number of open core designs and arrange for your attack to work with those configurations, which might be detectable in hardware or in the toolchain). Better yet, scramble the bitstream on every boot (but what would do the scrambling?).
    - klhugo 7y ago
      Yep. Great times are coming :D I think if you can enforce that the user will resynthesize the design on his own, and you make sure the synthesis/placement is different, you are way ahead of any other AISC alternative in terms of trust.
      - jacquesm 7y ago
        But that would automatically limit the deployment to a very, very small portion of the public, those tech savvy enough to do that. A few thousand to tens of thousands of people worldwide. Unless they would become ambassadors of sort - and assuming anybody else would even care - that would still leave the rest wide open. Cracking that is a difficult problem, you would have non-tech savvy consumers who need - or at least, that's what we think, your average consumer doesn't care at all - to gain access to secure devices. It would require a very large, visible and super embarrassing event to change the typical 'privacy is dead, get over it' mindset to switch to 'give me that secure hardware'. Right now the only people who would be interested are those that rightfully have something to fear from nation state level actors (spies, dissidents, politicians, would-be whistleblowers). And using a device like this would make them stand out like sore thumbs.
        kragen 7y ago
        > that would automatically limit the deployment to a very, very small portion of the public, those tech savvy enough to [resynthesize their CPU from source] Every time someone opens the Facebook web page, their browser recompiles the Facebook application from JS source, typically using ASLR. Facebook's user interface is vastly more complex than a CPU. Yet Facebook is not limited to a very, very small tech savvy portion of the public.
        mentat 7y ago
        Facebook's user interface is at least a few orders of magnitude less complex than a CPU. What would lead you to think otherwise?
  - ip26 7y ago
    Presumably you'd start with the standard sort of attacks, e.g. compromising any kind of hardware random number generation present.
- deleted 7y ago
  [deleted]
- eb3c90 7y ago
  I wonder if you can monitor energy usage (with an external chip) and compare it to what is expected to catch major changes. So for the FPGA you could load it with a risc-v arch and then run that arch through some performance load. If the energy usage has changed a lot it may well be doing something nefarious. Bonus points if you can have a (set of) reference fpga's in the cloud you can compare arbitrary work loads on so that it is harder to predict and be stealthy about nefarious activities. Use side-channel sources of information, where possible, to drive down the scale of changes possible.
  - xobs 7y ago
    This design does actually have a second external FPGA chip, which is in the "Untrusted" domain. It's running an ICE40UP5K, and acts more as the power management IC that turns the secure domain on and off.
  - jacquesm 7y ago
    I think that at some point in the future 'zero trust' will extend all the way down to the hardware level with individual components exchanging keys or otherwise nothing will happen. There simply won't be a safe perimeter within which you can trust another piece of hardware. And that's probably as it should be because a modern computer is better thought of as a network of - hopefully - collaborating processors than a single CPU with some RAM and peripherals. Any one of those can be turned against you.
- klyrs 7y ago
  > How will you know the mask of your FPGA isn't changed? https://spectrum.ieee.org/nanoclast/semiconductors/design/xray-tech-lays-chip-secrets-bare https://spectrum.ieee.org/nanoclast/semiconductors/design/xr... This actually sounds reasonable with an open source model. Masks are open, so a third party could xray chips coming out of various fabs. Since that's a nondestructive process, identical chips could be tested by multiple parties, and the community can compare notes.
  - jacquesm 7y ago
    Some of the mask changes suggested in this thread would have pretty serious security implications and would be very hard to detect so I'm not sure if that holds.
    - klyrs 7y ago
      Okay, yeah. Read some papers about some different attacks that avoid detection through such means. OTOH, those attacks do seem to rely on the simplistic nature of consistency checks. If this were used to make and open FPGA, it seems like we could run a very rigorous set of test structures that would exhaustively test the operations of various devices on-chip.
- wallacoloo 7y ago
  > unless you are willing to create your own fab or build your CPU up out of discrete transistors [...] It’ll happen someday. I think there are enough hobbyists interested in home manufacturing (of all sorts of kinds) that we’ll eventually have low barrier to entry home semiconductor fabs. They’ll probably sacrifice performance for simplicity — I can’t imagine a home fab ever being cutting-edge — but for most applications that’s fine.
  - techslave 7y ago
    not in the foreseeable future. the chemicals used are not for home use.
- Iv 7y ago
  In solving this problem, I think there is no perfect solution right now, just steps in the good direction. Making attacks harder instead of just impossible. The article is long so it is normal that many people did not read it to the end, which is a shame because I think the conclusion is really important: "I personally regard Betrusted as more of an evolution toward — rather than an end to — the quest for verifiable, trustworthy hardware. I’ve struggled for years to distill the reasons why openness is insufficient to solve trust problems in hardware into a succinct set of principles. I’m also sure these principles will continue to evolve as we develop a better and more sophisticated understanding of the use cases, their threat models, and the tools available to address them." It is a quest. It will be made of a lot of partial solutions. FPGA are just easier to inspect and their functions harder to backdoor if you don't know what they will run. Harder but by no means impossible. But at this stage if we can make things 50% harder in 50% of the cases, that's progress.
ip26 7y ago
IMO #1 is the Hard Problem. #2 seems, to me, like a minuscule fraction of the effort. In this day & age, with modern tooling, something similar to a Spartan 3E I would think could be done practically by a one-man team. The only obstacle would be money for the masks.
morphle 7y ago
I'm planning a free and open source Path Programmable Cell Array or as you describe it, an open source FPGA. This solves both the #1 hard tools problem and the easier #2 problem of $25k-$100K mask cost. I contacted you on Linkedin to see if we can work together on releasing this.

by klhugo 7y ago

jayjader 7y ago

I've seen things like this (https://www.crowdsupply.com/tinyfpga/tinyfpga-bx https://www.crowdsupply.com/tinyfpga/tinyfpga-bx) crop up on CrowdSupply. Not sure how close it is to what you have in mind.

jacquesm 7y ago

How will you know the mask of your FPGA isn't changed? I think that the idea behind all of this is sound but that at some point we will have to accept that there always will be some remnant of insecurity unless you are willing to create your own fab or build your CPU up out of discrete transistors which can be (1) exhaustively tested and (2) are too simple to contain anything nefarious given that there is no way to know where in a circuit that transistor will end up.

klhugo 7y ago
A couple things: 1. FPGAs are easier to verify cause they are regular structures. 2. How do you insert a backdoor in an FPGA at the supply chain if you don't know what is the exact logic that is going to be uploaded?
- jacquesm 7y ago
  > How do you insert a backdoor in an FPGA at the supply chain if you don't know what is the exact logic that is going to be uploaded? Popularity of certain open core designs might be one way to gain advance knowledge of how an FPGA might be used. That suggests an interesting option: to scramble the input to an FPGA in such a way that the device will still work but that it is even more unpredictable how its internal connections will be used (otherwise you could take a number of open core designs and arrange for your attack to work with those configurations, which might be detectable in hardware or in the toolchain). Better yet, scramble the bitstream on every boot (but what would do the scrambling?).
  - klhugo 7y ago
    Yep. Great times are coming :D I think if you can enforce that the user will resynthesize the design on his own, and you make sure the synthesis/placement is different, you are way ahead of any other AISC alternative in terms of trust.
    - jacquesm 7y ago
      But that would automatically limit the deployment to a very, very small portion of the public, those tech savvy enough to do that. A few thousand to tens of thousands of people worldwide. Unless they would become ambassadors of sort - and assuming anybody else would even care - that would still leave the rest wide open. Cracking that is a difficult problem, you would have non-tech savvy consumers who need - or at least, that's what we think, your average consumer doesn't care at all - to gain access to secure devices. It would require a very large, visible and super embarrassing event to change the typical 'privacy is dead, get over it' mindset to switch to 'give me that secure hardware'. Right now the only people who would be interested are those that rightfully have something to fear from nation state level actors (spies, dissidents, politicians, would-be whistleblowers). And using a device like this would make them stand out like sore thumbs.
      - kragen 7y ago
        > that would automatically limit the deployment to a very, very small portion of the public, those tech savvy enough to [resynthesize their CPU from source] Every time someone opens the Facebook web page, their browser recompiles the Facebook application from JS source, typically using ASLR. Facebook's user interface is vastly more complex than a CPU. Yet Facebook is not limited to a very, very small tech savvy portion of the public.
        mentat 7y ago
        Facebook's user interface is at least a few orders of magnitude less complex than a CPU. What would lead you to think otherwise?
- ip26 7y ago
  Presumably you'd start with the standard sort of attacks, e.g. compromising any kind of hardware random number generation present.
deleted 7y ago
[deleted]
eb3c90 7y ago
I wonder if you can monitor energy usage (with an external chip) and compare it to what is expected to catch major changes. So for the FPGA you could load it with a risc-v arch and then run that arch through some performance load. If the energy usage has changed a lot it may well be doing something nefarious. Bonus points if you can have a (set of) reference fpga's in the cloud you can compare arbitrary work loads on so that it is harder to predict and be stealthy about nefarious activities. Use side-channel sources of information, where possible, to drive down the scale of changes possible.
- xobs 7y ago
  This design does actually have a second external FPGA chip, which is in the "Untrusted" domain. It's running an ICE40UP5K, and acts more as the power management IC that turns the secure domain on and off.
- jacquesm 7y ago
  I think that at some point in the future 'zero trust' will extend all the way down to the hardware level with individual components exchanging keys or otherwise nothing will happen. There simply won't be a safe perimeter within which you can trust another piece of hardware. And that's probably as it should be because a modern computer is better thought of as a network of - hopefully - collaborating processors than a single CPU with some RAM and peripherals. Any one of those can be turned against you.
klyrs 7y ago
> How will you know the mask of your FPGA isn't changed? https://spectrum.ieee.org/nanoclast/semiconductors/design/xray-tech-lays-chip-secrets-bare https://spectrum.ieee.org/nanoclast/semiconductors/design/xr... This actually sounds reasonable with an open source model. Masks are open, so a third party could xray chips coming out of various fabs. Since that's a nondestructive process, identical chips could be tested by multiple parties, and the community can compare notes.
- jacquesm 7y ago
  Some of the mask changes suggested in this thread would have pretty serious security implications and would be very hard to detect so I'm not sure if that holds.
  - klyrs 7y ago
    Okay, yeah. Read some papers about some different attacks that avoid detection through such means. OTOH, those attacks do seem to rely on the simplistic nature of consistency checks. If this were used to make and open FPGA, it seems like we could run a very rigorous set of test structures that would exhaustively test the operations of various devices on-chip.
wallacoloo 7y ago
> unless you are willing to create your own fab or build your CPU up out of discrete transistors [...] It’ll happen someday. I think there are enough hobbyists interested in home manufacturing (of all sorts of kinds) that we’ll eventually have low barrier to entry home semiconductor fabs. They’ll probably sacrifice performance for simplicity — I can’t imagine a home fab ever being cutting-edge — but for most applications that’s fine.
- techslave 7y ago
  not in the foreseeable future. the chemicals used are not for home use.
Iv 7y ago
In solving this problem, I think there is no perfect solution right now, just steps in the good direction. Making attacks harder instead of just impossible. The article is long so it is normal that many people did not read it to the end, which is a shame because I think the conclusion is really important: "I personally regard Betrusted as more of an evolution toward — rather than an end to — the quest for verifiable, trustworthy hardware. I’ve struggled for years to distill the reasons why openness is insufficient to solve trust problems in hardware into a succinct set of principles. I’m also sure these principles will continue to evolve as we develop a better and more sophisticated understanding of the use cases, their threat models, and the tools available to address them." It is a quest. It will be made of a lot of partial solutions. FPGA are just easier to inspect and their functions harder to backdoor if you don't know what they will run. Harder but by no means impossible. But at this stage if we can make things 50% harder in 50% of the cases, that's progress.

ip26 7y ago

IMO #1 is the Hard Problem. #2 seems, to me, like a minuscule fraction of the effort. In this day & age, with modern tooling, something similar to a Spartan 3E I would think could be done practically by a one-man team. The only obstacle would be money for the masks.

morphle 7y ago

I'm planning a free and open source Path Programmable Cell Array or as you describe it, an open source FPGA. This solves both the #1 hard tools problem and the easier #2 problem of $25k-$100K mask cost. I contacted you on Linkedin to see if we can work together on releasing this.