7 ms·

A question for the designers (Paul?) about verifiability. In the software world you can effectively choose from 2 levels of review. You can (1) review the sourc

A question for the designers (Paul?) about verifiability. In the software world you can effectively choose from 2 levels of review. You can (1) review the source code of a project and convince yourself it's fine. Or (2) you can assume/hope that experts have done that, download the software, and just verify you have an identical copy of what everyone else is reviewing. (Ideally using signatures of the authors and reviewers.) Almost everyone who cares does step 2, assuming they do anything at all. Very few people are qualified or bother to review source code, but everyone who performs step 2 can feel pretty safe, as long as a release is big enough that it's getting reviewed by experts. So, what's the hardware equivalent? If I'm not capable of reviewing the schema of this hardware, but someone I trust says "this is great", how do I at least know the one I bought is identical to the one she/he bought (or built) and reviewed? How do I verify the components? This seems like a difficult problem.

robzyb 12y ago
You run your "verified" software on hardware, right? How do you know the hardware is verified?
- Taniwha 12y ago
  we publish the hardware design - in reality we have to run it on someone's chip, we've picked one that includes among other things AES, we just don't use that stuff, at some point we have to trust the CPU, and we use a CRC32 engine for minor whitening and stirring of our internal entropy pool - but crc32 is easy to verify (while AES is not) more importantly we've chosen a platform that we think is unlikely to have already subverted by 3 letter agencies
tribaal 12y ago
I think the idea is that the components are simple enough in the case that it can be reviewed visually by inspecting the circuit board and comparing it to a signed/verified reference. The last bit that is missing then is the chip's firmware, but apparently it is possible to get a dump of the firmware, so you can at least ensure it is what you expect. It will be a pretty interesting problem for cases. How can you both make a case that is practical and lets you inspect components? Maybe encasing the circuit board in transparent resin would work, but then you can't reprogram it anymore (which might be a feature). EDIT: Oh, that username rang a bell. Hi Chris :) Keybase.io FTW!
rsync 12y ago
I'm just brainstorming here ... but couldn't your software perform a test on the expected latencies and error rates of the hardware (on a very deep level) such that any additional (or subtracted) components would alter them in obvious ways ?
- kabouseng 12y ago
  I suspect random device variances will screw up the accuracy of your tests.
Taniwha 12y ago
the simple answer is that we publish our schematics and layout, just like software More generally, this is a pretty simple circuit the whole thing fits on a page (and we have a bit by bit explanation of how it works) looking it over is a 5 minute job, the firmware is far more complex.
kabouseng 12y ago
Would it be possible to publish JTAG scan chain results. This isn't fool proof, any device not connected to the JTAG chain will not show up, and illegal devices may spoof their responses.

robzyb 12y ago

You run your "verified" software on hardware, right? How do you know the hardware is verified?

Taniwha 12y ago
we publish the hardware design - in reality we have to run it on someone's chip, we've picked one that includes among other things AES, we just don't use that stuff, at some point we have to trust the CPU, and we use a CRC32 engine for minor whitening and stirring of our internal entropy pool - but crc32 is easy to verify (while AES is not) more importantly we've chosen a platform that we think is unlikely to have already subverted by 3 letter agencies

tribaal 12y ago

I think the idea is that the components are simple enough in the case that it can be reviewed visually by inspecting the circuit board and comparing it to a signed/verified reference. The last bit that is missing then is the chip's firmware, but apparently it is possible to get a dump of the firmware, so you can at least ensure it is what you expect. It will be a pretty interesting problem for cases. How can you both make a case that is practical and lets you inspect components? Maybe encasing the circuit board in transparent resin would work, but then you can't reprogram it anymore (which might be a feature). EDIT: Oh, that username rang a bell. Hi Chris :) Keybase.io FTW!

rsync 12y ago

I'm just brainstorming here ... but couldn't your software perform a test on the expected latencies and error rates of the hardware (on a very deep level) such that any additional (or subtracted) components would alter them in obvious ways ?

kabouseng 12y ago
I suspect random device variances will screw up the accuracy of your tests.

Taniwha 12y ago

the simple answer is that we publish our schematics and layout, just like software More generally, this is a pretty simple circuit the whole thing fits on a page (and we have a bit by bit explanation of how it works) looking it over is a 5 minute job, the firmware is far more complex.

kabouseng 12y ago

Would it be possible to publish JTAG scan chain results. This isn't fool proof, any device not connected to the JTAG chain will not show up, and illegal devices may spoof their responses.