Tag Info

New answers tagged

0

It appears the answer is: Use JavaCard. While individual smart card manufacturers all have proprietary crypto management software, you can use GlobalPlatform to load an OpenSC-compatible applet onto any blank JavaCard and get yourself white-box PKCS#11 functionality. Buying a couple of JavaCards now.


1

I'm really keen on what the Yubikey Neo does because it has so many open / generic modes (such that I've bought two), including presenting a CCID interface, OpenPGP supporting application on the card, and offering open source and specification U2F support. I think what you're ultimately looking for is CCID + a card with the appropriate applets. OpenPGP ...


1

No, not directly. As you've observed, SGX ensures the freshness and integrity of transient state in memory, but doesn't provide any mechanism (like a monotonic counter) for ensuring freshness of persistent state. So if you just want to rely on SGX on the local CPU, you can't protect against state rollback attacks. The general solution to this problem is ...


3

For DDR4: One DRAM manufacturer, Micron, indicated that they are putting rowhammer mitigations into some of their DDR4 DRAM (see this data sheet). Other manufacturers might be doing the same. Note that it is not necessarily true that "DDR4 is OK". There's nothing in the DDR4 standard that makes DDR4 memory safer than DDR3 memory -- the DDR4 standard does ...


0

Most HSM's allow for using custom code, but in general you have to ask the specific vendor, it's not something that they advertise. Often it breaks certification. On the other hand, running applications that can e.g. validate the input can make for a much more secure experience. Generally these applications are sandboxed and need to be signed. Of course, if ...


1

Basically most DRAM (dynamic-Random-Access-Memory) modules are vulnerable to rowhammer. If you want to be secure from the possibility of switching bits (after hourlong 'hammering', ofc), all SRAM (static-Random-Access-Memory) modules will do. SRAM is mostly used in Servers, it is more expensive but more stable (and in this case secure) against flipping ...


0

CPU Virtualization Basics CPU virtualization emphasizes performance and runs directly on the processor whenever possible. The underlying physical resources are used whenever possible and the virtualization layer runs instructions only as needed to make virtual machines operate as if they were running directly on a physical machine. CPU ...


0

Software auditing is easier since code is mostly done on standard platforms, whereas HW has at least two components: SW (firmware) and electronic components, which are sometimes proprietary and under patent laws. Reverse engineering a HW firmware is also possible, however you must deep understand how the electronic components work and what kind of ...


1

I wrote a partial solution to your need which I share. I only want to enable USB on exceptionnal occasion. I'm running a computer on which the use of an USB key can't be allowed. I wrote a shell script usb which is only switching on the required extensions to enable visibility of USB mass storage when I need it. Here is the man: Usage: usb [on|off|] To ...


0

Look on Phoronix.com for Purism reviews, Michael has done a few blog posts on topic, including some controversy about what Purism is doing with their firmware. Traditional IBVs (Independent BIOS Vendors) like AMI/Phoenix/Insyde have closed source codebases. Intel has Firmware Support Package (FSP) and AMD has ASGEA(sp) which contain the necessary blobs that ...


2

IMO, the only way to be sure about your firmware is if you build it and flash it yourself, and don't let system out of your hands. Intel Tunnel Mountain and MinnowBoard are the Intel dev platforms for UEFI. You can build your own firmware on these boxes. If you are concerned about this sort of thing, you might want to use a Novena or perhaps a Purism laptop ...


2

The only way to get control over your computer, that works always, is to physically replace the infected BIOS flash chip with a non-infected one (provided that only the BIOS is infected). It is possible that the flashing utilities aren't infected by the government, so you can perhaps even flash a non-infected BIOS from inside a system, which comes with its ...



Top 50 recent answers are included