IBM Hardwires Encryption Into Chips

zenwarrior writes "Reported by CNET, a new chip technology termed Secure Blue by IBM will keep users' data encrypted and secured at virtually every moment on essentially anything in which the chip can be used. Data is even encrypted in RAM, leaving display for users' viewing as almost the last place it isn't encrypted. This has to be considered decidedly anti-Homeland Defense by the current administration. If so, when will we see it if ever?"

Comments

Clipper Chip???

[DAldredge]

Like the last adminstration would have liked this tech? Face it - neiter party in DC likes anything that takes power away from them.

Re:Clipper Chip???

[jadavis]

Why are we speculating here? We've had encryption for a long time now, and it's not going away. If the powers that be don't like this, wouldn't they not like GnuPG?

The poster made the political comment with absolutely no backing at all. I wouldn't be surprised if IBM was not allowed to export this to Iran, but again, nothing new. And you don't have much justification that Clinton would have tried to do anything.

Re:Clipper Chip???

[thedletterman]

I'm amazed the article was posted with such a decidedly partisan jab. I don't see how the 'administration' has really affected technology available to the public or influenced domestic product availability. In fact, I'm pretty sure this would be a new power never weilded by the white house. Speaking then, from experience, the government wouldn't hinder this technology from being available throughout the US. Just don't expect to see it available for export anytime soon. It would actually strengthen homeland security by reducing the ability of china's hacker team to effect major change in our communications ability. Now if we could just start making EMP shielding a requirement for hardware critical to our infrastructure.

Re:Clipper Chip???

[Helios1182]

When public key crypto came out the government had a fit. Actually, the whole history of cryptography and the NSA is interesting. They fought it tooth and nail, but eventually had to come to terms with the public having strong crypto. Check out "Crypto, How the code rebels beat the government - saving privavy in teh digital age," by Steven Levy for some history in an interesting storylike format.

Re:Clipper Chip???

[Doc Ruby]

We're talking about the current administration, the one we've got, the one we can do something about. Not just partisan politics. But actual politics that go way beyond elections, to actually governing the country.

I know partisans want to do nothing but win elections, get the bribes and power. But we need politicians who can also run the country. And people who can communicate with them to ensure they represent us.

When Democrats have some power, even when balanced by a Republican other branch, the only bad politicians are Democrats. When Republicans have all the power, the only bad politicians are the old, half-forgotten Democrats. When Republican infallibility is debunked, then "neither party is good" - until Democrats no longer threaten Republicans. When did /. become FreeRepublic?

Re:Clipper Chip???

[InsaneGeek]

Other than trying to talk around it and obsfucate the question what are you saying? That the Dems would embrace this with open arms or not? here's a hint: if past history means anything look up the clipper chip

Re:Clipper Chip???

[jadavis]

My point was that the cat is out of the bag. Until we see the government try some funny stuff, let's not assume they will just because there is some incremental achievement in cryptography.

Re:Clipper Chip???

[Doc Ruby]

Wnat are you, illiterate? I'm saying what I'm saying: "the current administration, the one we've got, the one we can do something about".

So I will slap your obfuscation, talking around, and other insistence we talk about the dead past. right out of your hands.

The question is "will Bush stop IBM from supplying Americans with strong, easy encryption"?

It's not "can I think of something irrelevant to say about an administration from the past decade because it diverts attention from my favorite president".

Re:Clipper Chip???

[Anonymous Coward]

The question to ask here is: "what does secure mean?"

Secure against me, or secure for me? A super-secure system that can ensure that *only* I can get at the data, and does not allow third-party software to lock *me* out of that data... I'll buy. If it's another load of crap like Trusted Computing which makes explicit in its design that the root key is hidden from you, the owner, then it's no sale.

As the owner I want access to the entire contents of the machine if I wish. Otherwise, it will ultimately be used against you not for you.

Re:Clipper Chip???

[Stripe7]

Communications between the monitor and graphics cards are now going to be encrypted thanks to HDMI. Keyboards with encrypted communications to the computer are available. File system based encryption courtesy of Microsoft and encrypted tunnels via SSL. Soon RFID and Biometric devices for user login. Going to be interesting to see what the alphabet soup guys will be using to get into computer systems.

Re:Clipper Chip???

[networkBoy]

In a way this is not so incremental.
The fact that the entire system is encrypted, with the exception of the output device and in-CPU communication, electronic wiretapping can be made inpractable. Yes the crypto can be broken, but if the crypto holds up for either the statute of limitations &&|| the perps lifetime then you might as well not wiretapped at all.

Yes you can still get at teh output device, but if that device is a digital earphone (or better yet a bone conduction transducer) that decrypts at the output point, then you are SOL. Same goes for video, if it is one of those laser scanning thingies that "writes to the eyeball", then you can not intercept the signal in plaintext anywhere.
-nB

Re:Clipper Chip???

[modecx]

What we need, Doc is to kick out most of the goddamned lawyers and elect other professionals to fill their positions. Nearly every congressman, senator for the last bazillion years was either a lawyer or has had law training. It's ridiculous. What makes lawyers better at running a country than other professionals? We need ex-medical doctors, engineers, architects, scientists, biologists, mathematicians, programmers, chemists, librarians, teachers, dentists, pharmacists, nurses, psychologists, businessmen, merchants, farmers, etc. We need balance in the system. Back when this country was founded, there was more balance, but we need more yet.

Around two thirds of the attendees of the constitutional convention were either lawyers, or had law training, but the rest were involved in other occupations, similar to the ones I listed above, like merchants, securities traders, farmers, physicians, and had participated in misc. economic stuff. There were very few career politicians back then, and most of those who had political experience came upon it because of their occupations, business interests, because of trading, and just being outstanding men. Of course, post-constitution, most of these men actually did go further in politics, so maybe this was the beginning of career politics in our country...

Re:Clipper Chip???

[rainman_bc]

I'm amazed the article was posted with such a decidedly partisan jab. I don't see how the 'administration' has really affected technology available to the public or influenced domestic product availability.

Isn't the FCC demanding that VoIP have wiretapping capabilities? That's in direct relation to the Patriot Act that allows the FBI to do any wiretap they please without probably evidence.

Re:Clipper Chip???

[ncc74656]

I'm amazed the article was posted with such a decidedly partisan jab.

You must be new here.

Re:Clipper Chip???

[InsaneGeek]

Maybe you're the illiterate one here (or at least a little obtuse). They are already in office there is NOTHING that (let me use your words here) "we can do something about" And that really gets to the crux of the matter doesn't it, BOTH major parties are probably for this, we have direct proof with the clipper chip from the previous one, and we have a pretty damn good suspicion of the current one and how it will react to this.

The only thing that WE CAN DO ANYTHING about that is to not vote for either of them enough times (and vote for another that shares our views) so that one of the two major parties will accept those views. There is nothing we can do about the current or past administrations, but look at them and learn; and for some reason it would appear you don't want to look at the past.

Re:Clipper Chip???

[Anonymous Coward]

When Democrats have some power, even when balanced by a Republican other branch, the only bad politicians are Democrats. When Republicans have all the power, the only bad politicians are the old, half-forgotten Democrats. When Republican infallibility is debunked, then "neither party is good" - until Democrats no longer threaten Republicans. When did /. become FreeRepublic?

That explains why I never see any negative comments about Bush or Republicans here on Slashdot.

Re:Clipper Chip???

[Changa_MC]

They are already in office there is NOTHING that (let me use your words here) "we can do something about"

Well, there's always impeachment.

Re:Clipper Chip???

[deacon]

We're talking about the current administration, the one we've got, the one we can do something about. Not just partisan politics. But actual politics that go way beyond elections, to actually governing the country.

You are not going to "do" something about the current administration, so get over it. If Democrats come up with some ideas about running the country and present them to the people before the next ELECTION, then Democrats might actually get elected.

Note: "Bush is a Moron" is not a platform idea the Democrats can run on, because BUSH IS NOT A CANDITATE IN THE NEXT ELECTION.

While on some level it is amusing to see people in the thrall of Bush Derangement Syndrome, the country needs the Democrats to get a grip, get a message, and Move On, so that the voters have two viable parties to choose from.

The rest of your rant about /. being like Free Republic is to risible to deserve a response.

Furthermore, if we follow the suggestion in the supersig below, we can eliminate one of the components of voting fraud, and get an honest election result. ...

Make the requirements to vote the same as to own a gun.

Simply go to the polling place, fill out a Form 4473, show your ID, and the poll worker will check with the FBI database to make sure that you're not prohibited from voting. If everything is working correctly, you will be allowed to vote in a few minutes.

If the GCA/Brady system doesn't violate the rights of gun owners, then what possible objection could there be to implementing the same system for voting?

Robert Racansky

Re:Clipper Chip???

[Doc Ruby]

For one, we vote in the upcoming November elections. That certainly has effect, even beyond the typical party influences, especially with another factor, impeachment, on the menu. But of course there's all kinds of other political processes short of even reelection, that show up in the polls that pols live on, that controls the fundraising that they live and die for, that happens in the media that is their lifeblood, that lands in their mailboxes every day.

So you're illiterate, you don't know what illiterate means, and you don't know anything about politics. All you know how to do is bark "but but Clinton..." whenever your politics nerve gets a spike. Tell you what - ignore everything I said. There's nothing you can do about politics until the 2008 elections. Don't bother doing anything until then. You won't be missed.

Re:Clipper Chip???

[Doc Ruby]

I'm going to do something about Bush in the election in 7 months: I'm going to vote for candidates that will produce laws under different policies than Bush's failed ones for at least the next two years left in his term. And for candidates that will do other things about Bush himself while he's still around: censure, impeachment, whatever will stop his criminal acts. "Bush is a moron" will be a welcome plank in their platform, on which they certainly can run - as long as they're not morons. Their job as the opposition minority is to stop Bush and Republicans whenever they must, whenever they can. Especially when they're shut out of legislating by Republican rule gaming and majority tyranny, they can barely do that. Since their party can't pass legislation over the rubber stamp of the Republican drones, they're not in a position to produce policies. Even standing in the way of the Republican bulldozers is enough work. Not that Democrats have had their shoulder to that wheel all the time the past 6-12 years, but that's their maximum.

The FreeRepublic comment was directed to the poster to whom I replied. That you take exception to it is an unexpected, though telling, byproduct.

I like your instant voter registration/voting plan, probably with some tweaks. But none of those things involve guns. Where have your guns been for the past 5 years he's been destroying our country?

Re:Clipper Chip???

[InsaneGeek]

Dude you truely have blinders on don't you... you are one biggoted bastard (look up definition of a bigot). READ WHAT I WRITE, you obviously THINK you can read, now do it. If you were to read what I post rather than look through your hate filled bigot eyes you'd see that I call both parties on the table. That both parties act that way, maybe you are too stupid to look more than a few years back, maybe you are so young that you only live in the now, maybe you are destined to repeat all the failures; while I am looking at yesterday, today, and tomorrow. You have some notion that all I say is clinton this and clinton that, READ MY POSTS, READ THEM YOU STUPID IDIOT.

It's becoming very, very obvious that you are a clinton apologist where I've only shown that I apologize for neither bush or clinton, and complain about them both. (FYI: this post is the first time I ever mentioned clinton, but you obviously can't read)

Re:Clipper Chip???

[Anonymous Coward]

Where have your guns been for the past 5 years he's been destroying our country?

Are you suggesting that the people the left-wingers have been slandering and trying to disarm should now use their guns against the government because you hate George Bush and Republicans?

"But I also know there have been lawbreakers among those who espouse your philosophy....How dare you suggest that we in the freest nation on Earth live in tyranny. How dare you call yourselves patriots and heroes."

That you take exception to references to Clinton and the Clipper Chip (countering the partisan comment in the original story) is an unexpected, though telling, byproduct.

Re:Clipper Chip???

[Anonymous Coward]

When Democrats have some power, even when balanced by a Republican other branch, the only bad politicians are Democrats. When Republicans have all the power, the only bad politicians are the old, half-forgotten Democrats. When Republican infallibility is debunked, then "neither party is good" - until Democrats no longer threaten Republicans. When did /. become FreeRepublic?

This should read:

When Republicans have some power, even when balanced by a Democratic other branch, the only bad politicians are Republicans. When Democrats have all the power, the only bad politicians are the old, half-forgotten Republicans. When Democrat infallibility is debunked, then "neither party is good" - until Republicans no longer threaten Democrats. When did /. become a left-wing site?

Re:Clipper Chip???

[Anonymous Coward]

Wnat are you, illiterate?

Wnat's "wnat" meah?

Re:Clipper Chip???

[Doc Ruby]

I'm directing my comments directly at you, not some mysterious bugbears like your favorite cartoon hobbyhorse. Not Clinton or anyone else you're insisting on dragging into this thread no matter how irrelevant - especially that straw man Clipper Chip jive that I never mentioned. I'm calling you out - where have you been with your treasured "freedom insurance"? Typing away. What are you waiting for?

Re:Clipper Chip???

[Doc Ruby]

It's typo-nazi bait. Congratulations!

Re:Clipper Chip???

[Doc Ruby]

"The facts are clearly biased against George W Bush." - the Daily Show (paraphrase)

Re:Clipper Chip???

[thedletterman]

I'm amazed the article was posted with such a decidedly partisan jab. I don't see how the 'administration' has really affected technology available to the public or influenced domestic product availability.

Isn't the FCC demanding that VoIP have wiretapping capabilities? That's in direct relation to the Patriot Act that allows the FBI to do any wiretap they please without probably evidence.

That's not a very good example. VoIP is freely available. Demanding access to communication isn't the same as affecting the availability of a product.

When will we see it, if ever?

[magetoo]

My guess: In media center PCs in 3... 2... 1...

Re:When will we see it, if ever?

[frovingslosh]

Yup, mod parent up. Some might call this anti-homeland defense (particularly if the childishly believe the feds can't get your data this way), but the reality is that it is a maror shove in the DRM direction. With DRM already in the SATA hard drives, this is another way to fence the user away from their data. And what happens when Windows does it's all too common trick of refusing to boot and let you at your existing files? Well just reinstall everything (from the CDs that the major OEMs like Dell no longer even bother to give you) and retype it, because you sure are not going to recover it any longer. This is called trusted computing.

Re:When will we see it, if ever?

[arminw]

.....And what happens when Windows does it's all too common trick of refusing to boot and let you at your existing files?....

I suppose the way around all this "security" is to print out everything that is REALLY important right after you create it and store it in an old fashioned filing cabinet like was done before computers existed. That way you'll always have your data.

Pretty cool

[liliafan]

Interesting report but I would like to see more details, what type of encryption is being used? I think this would be a great thing, however, I can see it being blocked from ever reaching the market due to home security risks, unless there is a backdoor installed which really makes it kinda pointless in the first place.

Regardless it is very interesting that they say this technology can be used on any chip and not just powerPC's, also is the encrypted data tied to the chip or the system, how would this effect SMP systems, or virtual partitions?

Re:Pretty cool

[TheGratefulNet]

IANAS (I am not a spook) but I fully believe that ANY and ALL encryption devices MUST have a NSA backdoor. or you will not be allowed to develop and sell in the US.

I did work for a company a long time ago who was doing video encryption and they had to have 'permission' to use it and they also had to demonstrate that it wasn't so hard that the NSA _could_ break it, if they wanted to.

routers having to have backdoors (vendors will deny it, of course), ports being mirror-able at NSA request, its all 'business as usual' in the modern USA ;(

when the POTUS goes on fishing trips to try to find guilty people sans any direct evidence, do you REALLY think that this encryption will be totally sealed, end to end, and only the end user/owner will have the key?

its getting to the point where the only encryption you can really trust is one you ENTIRELY write yourself. and how many of us can do that?

any hardware design - you KNOW it will be sent to the NSA for approval. perhaps not using official/visible channels, but you know how this world REALLY works, don't you? ....

any time that security is sold to you as a 'user feature' by some NSA-friendly vendor (ie, any US company), you better believe its just 100% the opposite.

Re:Pretty cool

[Azarael]

If this type of technology gets blocked, then I hope that the same happens for DRM technology (unlikely) because it seems to me that they both do the same thing. In any case, I'm not sure how a gov't can mandate a type of information restriction (e.g. DRM) and make another practically identical restriction illegal. Even if you restrict access of the technology somehow, I'm sure that someone could find a way to slide their own material in anyway.

Re:Pretty cool

[c0l0]

From what I've heard the encryption scheme to be implemented by the "Secure Blue" chip is supposed to be based on a sophisticated algorithm called "Triple-ROT52", developed at an university in Australia. Neat stuff, indeed!
 
 

Now let's lean back and see how long it takes for the Inquirer to pick this up...

Re:Pretty cool

[magetoo]

Interesting report but I would like to see more details, what type of encryption is being used?

From TFA:

Secure Blue requires a few circuits to be added to a microprocessor, taking up a small percentage of the overall silicon real estate, according to IBM. The encryption and decryption happens on-the-fly, without any processor overhead, the company said.

(emphasis added by me)

It would seem to me that the highlighted phrases above would set some sort of bound on how sophisticated this encryption can be. Besides, there's probably a bigger incentive to offer encryption that is "good enough for DRM" than there is for offering encryption that is "uncrackable within the nearest 1000 years, even by governments". (Yeah, I realize I'm not adding much useful saying that...)

Besides, it just looks like something to dangle in front of "content providers" (encrypted all the way up to the last step, etc). Paranoid geeks are, I guess, more likely to depend on software tools (PGP/GPG, encrypted partitions) to keep data safe.

Re:Pretty cool

[TheRaven64]

This sounds pretty paranoid, and easy to circumvent. No one is trying to ban OpenBSD in the US, for example, and it includes strong encryption (developed outside the USA), and is used on a number of router and firewalls.

Re:Pretty cool

[zippthorne]

My (admittedly weak) understanding of the law is that it's perfectly acceptable to sell the encryption tech domestically, but it would be illegal to export such a device without the backdoors (or being crippled enough to not require backdoors).

Re:Pretty cool

[windowpain]

I'm not so sure that the Feds require encryption backdoors for devices. I think you may be thinking of CALEA and related laws. But AFAIK they refer only to tapping phone lines, rather than encryption.

Even if the Feds do pass a law requiring backdoors for devices, the law could be circumvented by doing the encryption in software. Not as convenient for the end-user perhaps, but millions of people around the world do that every day thanks to the various implementations of public-key (RSA) schemes.

Software trapdoors trump hardware backdoors.

Re:Pretty cool

[Feyr]

it used to be the case that anything related to encryption (application, patent, you name it), had to be vetted by the NSA. even the venerable DES (which was developped by IBM) had NSA input in it

not so much anymore. there might be some cases, but it's not a blanket policy anymore. the PGP case pretty much killed that

Re:Pretty cool

[Old Grey Beard]

based on a sophisticated algorithm called "Triple-ROT52" Wow -- this is the exact algorithm I use when shuffling cards! I didn't know the Aussies got there first. Then again, I did lose my shirt in a poker game in Sydney a while back...

Re:Pretty cool

[TheGratefulNet]

someone modded me 'flaim bait'?

whatever....

I used to work in the router/switch industry. I have -some- clue about what I'm talking about.

cover your ears and eyes if you want, but the fact is, the US gov DOES want to be able to have its 'fingers on the bits' on-demand.

this isn't your father's america anymore. it really isn't.

Re:Pretty cool

[kimvette]

"uncrackable within the nearest 1000 years, even by governments"

That may be true when the work is done by contractors who want to milk every possible last cent from taxpayers, but not true of a community of engineers and geeks who are determined to crack the encryption (be it DRM or other purpose) using a massive P2P shared computing network. Besides, those "time to crack" estimates are a) fiction b) resume that the correct result will be the final possible permutation and not the first or somewhere between and c) presume a single computer plugging away at it using brute-force methods

Re:Pretty cool

[adisakp]

ROT52 is pretty useless for playing cards assuming it's from the same family as ROT13. As a matter of fact triple-ROT52 has the exact same results as double-ROT52 or single-ROT52. Now that I mention it, the results bear a striking resemblance to that of AND-xff and OR-x00 algorithms. SHUF52 is much better.

Re:Pretty cool

[Anonymous Coward]

So I guess this means I can come out of my Farady room now.

Wonder what they can do about Van Eck phreaking.

Nervously adjusts tin foil hat and gulps.

Re:Pretty cool

[Kjella]

Even if the Feds do pass a law requiring backdoors for devices, the law could be circumvented by doing the encryption in software. Not as convenient for the end-user perhaps, but millions of people around the world do that every day thanks to the various implementations of public-key (RSA) schemes.

In theory, if that backdoor included the possibility to spy on processes running then no software crypto would be safe. I would believe it could be built into the hypervisor layer of Vanderpool/Pacifica (Intel/AMD) without attracting any attention. In standard libraries like OpenSSH's should certainly be easy to map out where and when you can snap up the key, presumably the moment it is invoked.

Re:Pretty cool

[skiflyer]

Only to a point, it is possible to make time to crack estimates which use the "every atom in the universe working to solve the problem" estimations... namely the NP-Complete problems like PK-Encryption.

Re:Pretty cool

[Anonymous Coward]

Because we've never seen electrical engineers design backdoors into difficult-to-reverse-engineer silicon, no, never.

Re:Pretty cool

[shadow_slicer]

But Triple-ROT52 only works with a small subset of 7-bit ascii plaintext.
I think they're using either Quadruple-ROT64 (supports 8bit ascii) or Octuple-ROT536870912 (for proper unicode support).
Either way it's kind of silly to use a data-dependent algorithm here...

Re:Pretty cool

[Alsee]

CPUs operate on binary data - nothing but zeros and ones. They are actually using Triple-ROT1.

-

Re:Pretty cool

[Anonymous Coward]

How about you buy a new wife?

DRM

[Ingolfke]

This can help you, the end-user secure your data, but is also a necessary component of a DRM hardware solution.

Re:DRM

[BadassJesus]

DRM will never work (as explained thousand times). What you can see or hear can be easily replicated. DRM failed and will fail again.

Come up with fair prices and easy to use players as Apple did. And you've got win-win scenario without DRM even come into play.

Re:DRM

[linguae]

Come up with fair prices and easy to use players as Apple did. And you've got win-win scenario without DRM even come into play.

Hmmm, doesn't Apple use DRM in its iTunes music and in OS X?

Re:DRM

[babbling]

The purpose of DRM isn't to stop people copying. That is just the stated purpose. There are other motives involved.

Re:DRM

[GreyWolf3000]

Not one that relies on draconian hardware chips that prevent you from having control over your computer. So while the parent wasn't perhaps as thorough in his explanation, he still had a point.

Re:DRM

[tepples]

What you can see or hear can be easily replicated.

Unless the importation and interstate/interprovince sale of high-resolution sound cards and video cameras is regulated, such that a licensed and bonded audiovisual engineer must supervise each unit's use and storage. I see no reason why the situation described in The Right to Read could not happen tomorrow.

Re:DRM

[Anonymous Coward]

you mean like the tpm chip in the mactels that are required to run osx?

Re:DRM

[heinousjay]

Care to elaborate?

Re:DRM

[onecheapgeek]

He could, but he'd have to rename himself "coherentexplanation".

Re:DRM

[Firehed]

It locks you into certain hardware. Not too many people will be keen to switch to a PlaysForSure-compatible player if they've got an iTunes library full of protected AAC songs. In any case, it's a futile attempt to do so as there are so many ways to deal with it, but it'll certainly deter casual users (read: those that can't be bothered to burn and re-rip their whole purchased library) from switching. CSS? It's not to stop copying DVDs, it's to make sure that everyone who makes players has to pay a licensing fee. Why else can you grab PC DVD player drives for <$20 where a standalone DVD player starts around the $40 mark?

They know damned well that until our brains can decode encrypted digital video and audio, they can't stop copying. It must be converted to analog before we can use it, and while they can hamper things, there's absolutely no way to stop microphones and camcorders. It's for the sole purpose of extracting as much profit from everyone as possible. The anti-piracy makes a decent cover, but in reality it's one of the largest anti-competitive schemes in recent history.

Re:DRM

[Graftweed]

Hear, hear. I wish people (i.e. the media at large) would stop perpetuating the myth that DRM has something to do with preventing piracy. Can you play DRM restricted tracks bought from iTunes on any player other than the iPod? No? Then DRM has achieved it purpose.

Re:DRM

[Amouth]

My question is if it is encrypted everywhere even in the chip..

how the hell do you proccess encrypted assembly --- for this i am at a lost.

XOR because a pointer address and you just foobared your proccess which you can't read..

what is the over head on this thing.. Not only does it sound too good to be true but it sounds too good to even work

Re:DRM

[Anonymous Coward]

This can help you, the end-user secure your data, but is also a necessary component of a DRM hardware solution.

Every technology is a double-edged sword. I'd much rather have better tools available, and for instance this processor would be wonderful for things like cash registers, credit/debit card processors, and any other embedded system that has to be put into a potentially hostile environment. DRM could benefit from these processors of course, but the analog hole is a much bigger problem for DRM, not to mention that unless the processor was heavily integrated with TCPA, it would be very difficult to securely set a DRM key in the processor without the operating system being able to steal the key. I think that software bugs will leave massive gaping holes in all DRM systems, even those tied to TCPA, that will make them effectively useless as well.

On the consumer rights side, this processor would allow you to keep your fifth amendment right by encrypting your RAM and your hard disk at effectively no cost, since the processor will probably have the ability to output either encrypted or unencrypted output to IO devices as well. Encrypting RAM is useful in that if you want to run a "secret" server, just boot it with an ephemeral key and leave it plugged into a UPS. As soon as the power goes out, the entire thing turns into a big pile of entropy.

I imagine IBM will use something like AES-LRW, and hopefully will have authentication support built in. For instance, if you don't bother authenticating each block of data decrypted by the processor, an attacker can modify the blocks that hold data pointers or security permissions and invalidate them, causing either a crash or in the worst case a security breach by setting the processor into a non-encrypting mode or have it pull the wrong data to output to an unencrypted device. The problem is that for secure authentication, they would probably have to double the RAM on the system and store each encrypted block next to its MAC, since there's no way they could compute a MAC over an entire page of memory for each read/write access. Still, doubling the amount of RAM needed is a small cost compared to being able to implement a secure e-cash system, for instance.

Re:DRM

[C0vardeAn0nim0]

"Why else can you grab PC DVD player drives for $20 where a standalone DVD player starts around the $40 mark?"

because PC drives doesn't have power suplies, decoder chips, remote controls, AV outputs, cables and built-in OS and software to handle menus, RC events, and the like ?

DVD drives for PCs have the same CSS protections that stand-alone players do, this means they pay the same fees to those @$$holes af the DVD consortioum. they're cheaper because except for CSS decription, everything else is done by the host computer's CPU (menus, MPEG decoding, etc.)

Re:DRM

[arminw]

...Hmmm, doesn't Apple use DRM in its iTunes music and in OS X?....

Apple lets you burn the iTunes music to an ordinary audio Cd with no DRM. After you do that, such a CD is no different from any other standard audio CD you can buy in a store. All they are trying to stop are the unethical people who post music files in the Internet for anybody to download. If such malefactors didn't exist, nobody would have ever even thought of wasting a dime on DRM.

Re:DRM

[Firehed]

Ah, but no. If that were true, then you wouldn't need to buy DVD player software. The PC-DVD drive spits out data that's still encoded, which then relies on software to unscramble it. If you paid the licensing fee as part of the drive, then open-source DVD playing software would be legal as it wouldn't have to do any unscrambling, just drawing the video on the screen (and software like DVD Decrypter would have no purpose, other than possibly stripping out region coding or UPOs). You said it yourself, though, they don't have decoder chips. I'm sure you meant DACs, which would be quite true. The rest of the stuff you mention costs pennies when bought in the level of bulk that Samsung, Sony, Panasonic and all the others do. Probably $5 max including the remote.

The cheapest DVD player I've *ever* seen was something like $29. The cheapest DVD drive I've seen was about $14. Typical pricing starts around $50 and $20 respectively, give or take a few bucks. Your standalone player is, in effect, a PC DVD drive in a modified shell, with an integrated PSU, CSS decrypter, DACs and various outputs, with a different firmware (interacting with the remote and menus, rather than just seeking to different parts of the disc). Like I said, most of those parts are very cheap, but DVD playing software for your computer all starts around the same price which approximately makes up that price difference.

Re:DRM

[jbridge21]

The additional chips cost more than you think. For example, a random MPEG2 decoder chip meant for use in a set top box: $11 in volume. link

Re:DRM

[C0vardeAn0nim0]

maybe i didn't expressed myself correcly, DVD drives have buil-in protection to prevent the user from simply copying the .VOB files from the disc to the HD. but this doesn't change the fact that they still pay fees to the DVD consortium.

software DVD players like winDVD cost money not just because of the DVD consortium licensing fees, even if there was no fee, the developers would still need an MPEG decoder (either developed in-house or licensed) wich cost money, thei'd have to offset development costs, marketing costs, etc. the only diference is that without the fees the chances of having a _legal_ (at least in US. in some other countries deCSS is legal) opensource decoder would be bigger.

and no, you can't add a hardware decoder, power supply, case, AV conectors, RC and other stuff to a PC DVD reader to turn it into a standalone player for less than $10-$20 bucks, no matter how cheap the components are.

Or Sponsored by DHS?

[MooseByte]

"This has to be considered decidedly anti-Homeland Defense by the current administration."

Unless they designed the backdoor to be inserted....

Re:Or Sponsored by DHS?

[elrous0]

Unless they designed the backdoor to be inserted....

You can bet on it.

-Eric

Re:Or Sponsored by DHS?

[Anonymous Coward]

well thats not even funny to joke about! start fighting back, heres a quote from somone on anonet for why they do what they do:

Because everyday more and more of our freedoms (it doesn't matter where you are in the world) are taken away. Now they are starting in on the internet. So I figured it was time to build something "they" don't control and start it sooner rather than later.

thats good enough for me, anonetnfo.brinkster.net.nyud.net:8090 - it might be seen as an advert, but it wasn't intended to be one

Re:Or Sponsored by DHS?

[Jeremi]

You can bet on it

Can you? If anything about the government-installed backdoor ever became public knowledge, IBM would be facing all kinds of lawsuits from anyone who ever bought that chip, would probably have to refund or replace every copy of the chip they ever sold, and it would be a long, long time before anyone would seriously consider buying a "secure" chip from IBM again.

I like a crypto-fascist conspiracy as much as the next guy, but wouldn't that be an awfully big marketing risk for IBM to take?

Re:Or Sponsored by DHS?

[Lehk228]

this administration is far too prudish to get involved in back door insertion

Re:Or Sponsored by DHS?

[WinstonSmith2600]

If a big company puts out something with encryption then there is no doubt that it has a backdoor. It wouldnt be the first time this happened. What would be nice is if it was open source so you could rewrite it or update it. But even then I bet they would add some hidden non-erasable backdoor.

Re:Or Sponsored by DHS?

[kimvette]

I know you meant that as an off-colour pun, but seriously, the current administration appears hell-bent on eliminating liberty as our parents' generation knew it.

Re:Or Sponsored by DHS?

[elrous0]

Yes, it's a big marketing risk. But what is that compared to having the U.S. Government gunning for you?

Besides, if the NSA declares this backdoor "classified" then very few reporters or leakers would be inclined to spill the beans, lest they be thrown in jail/stripped of their pensions/etc.

-Eric

Re:Or Sponsored by DHS?

[Anonymous Coward]

Back when I was in university, I had a computer security prof who was a bit of a conspiracy nut. He'd tell you that the government doesn't need a back door, because whatever encryption algorithm IBM's using, the NSA can already crack it.

For example, back in the 70's, the NSA suggested some changes to DES while it was being developed. They weren't weakening it so that they could crack it... they were hardening it, so that it would still be secure against a form of attack that used advanced mathematics techniques that hadn't been discovered yet by civilians.

The cynical and paranoid believe they did this because they had yet another, even more advanced method of cracking DES. More trusting people might suggest that the NSA actually wanted the encryption to be secure, since DES was going to be used by other government agencies.

Either way, they don't want a back door. They'll either want americans to have access to solid, reliable encryption... or they're so far ahead of us, they don't need any extra help breaking through our feeble attempts at security. ;)

Re:Or Sponsored by DHS?

[itchy92]

This is such a pussy statement. "Our freedoms are being taken away every day, but now they're coming for our internets, so we're going to make a stand!" Why don't you make a stand in the real world, where it actually matters? Is it just because it's so much more convenient to do it from the comfort of your home, masked by (at least some) anonymity? If you truly believe in freedom, you should be out there protesting, rallying revolution, doing something other than whining when they come after your last bastion of freedom.

And so should I.

Re:Or Sponsored by DHS?

[thewiz]

I like a crypto-fascist conspiracy as much as the next guy, but wouldn't that be an awfully big marketing risk for IBM to take?

Not really. Didn't you know that the U.S. government is a wholely owned subsidiary of IBM?

Re:Or Sponsored by DHS?

[asuffield]

I like a crypto-fascist conspiracy as much as the next guy, but wouldn't that be an awfully big marketing risk for IBM to take?

Which is precisely why the NSA would not tell IBM that they were inserting a backdoor into the chip. Oh, some IBM employees would doubtless have to know about it, but they would be in the employ of the NSA - IBM as an organisation, and specifically their management, would be unaware that this was happening. You don't really need to control a large number of people to pull it off - there would just be a little extra bit added to the chip designs right before they go to manufacturing, and removed again before the test results are sent back.

Re:Or Sponsored by DHS?

[Kjella]

Back when I was in university, I had a computer security prof who was a bit of a conspiracy nut. He'd tell you that the government doesn't need a back door, because whatever encryption algorithm IBM's using, the NSA can already crack it.

They are certainly among the best in the field, and yes they did improve DES. However, that doesn't change the fact that many published encryption schemes like GOST (Russian), Rijendael (European, better known as AES) were developed outside the US. Very many cryptographers have taken a whack at both those and US algorithms, and they seem to hold. To think that the NSA has solvers for all of these and the rest of the world can't find solvers for any of them, is putting too much faith in the NSA. It seems quite obvious at this point that secure encryption does exist. Of course, there's always the chance the NSA has broken some of these algorithms, which they aren't very likely to talk about. But I strongly doubt they've cracked all of them. And as far as brute force go, it wasn't too long since 40 bits was the limit, now 128bit is everywhere. I strongly doubt their breaking capability rose with 2^88 in that time, I think it's more a case of the cat being out of the bag.

Re:Or Sponsored by DHS?

[CodeBuster]

I think it's more a case of the cat being out of the bag.

Remember also that the NSA is concerned with practical mission concerns and not just the theoretical side of cryptography. In the real world the weakness is rarely in the algorithm chosen, but rather in bungled key management, social engineering, or other physical security concerns which serve as the weak link in the chain. The NSA would not bother brute forcing your key if they could log your keystrokes from a van parked somewhere in the neighborhood or bug your keyboard while you are not home or trick someone at your company to give out the passphrase during a pretext phone call, or any number of other ways that intelligence agencies know about. The secure transmission and storage of keys is the real problem and most private entities are no match for experienced agents of the system when it comes to securing their sensitive data.

Re:Or Sponsored by DHS?

[Burz]

I like a crypto-fascist conspiracy as much as the next guy, but wouldn't that be an awfully big marketing risk for IBM to take?

Backdoors and encryption are seperate things. But adding encryption to the deepest levels of backdoor-laden hardware would be one of the best ways to minimize risk to their brand.

Any device or feature that attempts to put a machine's activities beyond analysis should be treated with deep suspicion. And the corporate elite have already made their intention clear: To create a planetwide nervous system that looks after their interests, starting with DVDs and streaming media.

Think having Tony Blair's people watching you in all the public spaces is bad? Wait til you realize that multinational corps are surveiling you everywhere else!

Re:Or Sponsored by DHS?

[deviceb]

the notion is obsurd, people crack me up. And on top of IBM secretly installing backdoors??!!? IBM is one of the companies that has been pushing Crypto & non windows technologies... they are a stand-up company. -If there is any! not to mention no matter what you say.. they phreakin invented computers as we know them. I trust them to know best which way to push... if anybody does

Re:Or Sponsored by DHS?

[Anonymous Coward]

"Can you? If anything about the government-installed backdoor ever became public knowledge, IBM would be facing all kinds of lawsuits from anyone who ever bought that chip, would probably have to refund or replace every copy of the chip they ever sold, and it would be a long, long time before anyone would seriously consider buying a "secure" chip from IBM again."

Let's try the following:

"Can you? If anything about the government-installed NSA backdoor ever became public knowledge, Microsoft would be facing all kinds of lawsuits from anyone who ever bought that Operating System, would probably have to refund or replace every copy of the Operating System they ever sold, and it would be a long, long time before anyone would seriously consider buying a "secure" cryptographic-enabled Operating System from Microsoft again."

Really, I mean, which variety of igneous rock have you been shacking up with for the past decade, man?

http://news.bbc.co.uk/2/hi/science/nature/437967.s tm

"It's legal because the President ordered it."

And of course, exactly how many people have the ability to strip a package off a submicron-process-produced piece of silicon and examine the etchings to ensure there's no backdoor? Got the tapeout? Got the VeriLog files? Are you an exec or chief engineer for IBM? They don't have to outsource their manufacturing to Taiwan/China/Malaysia either.

Homeland Security Vrs RIAA

[Jumbo Jimbo]

This has to be considered decidedly anti-Homeland Defense by the current administration. If so, when will we see it if ever?

Anti-Homeland Defense, maybe, but avoiding data leakage will make it very attractive to RIAA / MPAA and other copyright protection lobby groups.

So Maybe we get to see what happens when the RIAA face off against the Department for Homeland Security and the CIA - that would be one I would like to see (Maybe we should just watch them fight them nuke them both from orbit - only way to be sure).

Re:Homeland Security Vrs RIAA

[Ohreally_factor]

What's to stop the government from seizing both you and your computer, flying you out of the country, and then torturing you until you give up the password?

Besides which, I'm pretty sure the RIAA and the MPAA will get behind this, and they've got Congress in their pocket.

Re:Homeland Security Vrs RIAA

[try_anything]

Business vs. security? No contest. Why do you think security regulations that supposedly protect us from terrorists also help companies hide bad behavior from citizens, and the Pentagon's budget is filled with boondoggle projects it doesn't even want? The military and the security complex aren't political power centers -- yet.

Re:Homeland Security Vrs RIAA

[zephos]

Although this will certainly deter certain easier methods of cracking DRM technologies it won't [nor can it] stop the persistent for the a very important reason; the hacker is also a legitimate user.

At some point the data-stream needs to be decrypted and presented to the user and at that point the data is no longer secure and subject to being copied.

Until monitor/speaker/etc manufacturers decided to allow encryption in their hardware there will always been vulnerable points to stealing content.

Though I am overwhelmingly happy that someone has decided to take the idea of privacy and security seriously enough to provide an easy solution to securing people's data.

Re:Homeland Security Vrs RIAA

[DoraLives]

we get to see what happens when the RIAA face off against the Department for Homeland Security and the CIA

These outfits are the same side of the same coin, so there will be no "face off." They're all in cahoots together and you can rely on the fact that the RIAA or any other *AA will fall all over themselves attempting to give the DHS or whomever, any little thing their hearts desire, including whatever keys to whatever algorithm they may be interested in at any given time. It's YOU AND I who are on the outside looking in, here.

Re:Homeland Security Vrs RIAA

[x2A]

Assuming their interest in your data's justified, doing that takes time they might not have, and might alert others they're onto you. Assuming their interest isn't justified (eg, "got the wrong person", "misinterpreted evidence", "magic 8ball got stuck"), I'd rather they hack in to find out that I've got nothing of interest to them, than them flying me out somewhere and torturing me for the password, THEN find out I had nothing of interest to them, and deciding /what/ to do with me?

Or even better, I'm just gonna stay away from the USA!

Re:Homeland Security Vrs RIAA

[evilviper]

What's to stop the government from seizing both you and your computer, flying you out of the country, and then torturing you until you give up the password?

Well, the obvious one being that installing a pinhole camera, keystroke logger, or parking a tempest van outside would be infinitely cheaper and easier.

The second one being your brain, and a rubber-hose: http://iq.org/~proff/rubberhose.org/current/src/do c/review.html

Re:Homeland Security Vrs RIAA

[Anonymous Coward]

What's to stop the government from seizing both you and your computer, flying you out of the country, and then torturing you until you give up the password?

Could this person have any more crazy, delusional, tinfoil-hatted faith in the government?

I mean, why exactly would they bother to fly you anywhere?

Re:Homeland Security Vrs RIAA

[Fareq]

Or even better, I'm just gonna stay away from the USA!

A perfectly reasonable choice... though I'm curious where you are going to go/be/stay instead.

Re:Homeland Security Vrs RIAA

[electronerdz]

Maybe we can use Homeland Security to our defense... how do we know that instructions to making bombs isn't encoded right into DRM enabled video and music. What if terrorists used DRM enabled MP3 files to send messages back and forth. How could the government ever see what is inside them?

Re:Homeland Security Vrs RIAA

[kimvette]

Why? Because Gitmo is a nice convenient place to hold "ter'rists" and "enemy combatents" who happen to disagree with Duhbya. It's kind of hard to make a phone call or get ahold of any members of the media where they lock you in a room and then throw away the room. (yes, I ripped off the "throw away the room" bit)

Re:Homeland Security Vrs RIAA

[x2A]

OMG! You're ONE OF THEM! I'm not telling you!

*runs away screaming*

Re:Homeland Security Vrs RIAA

[Ohreally_factor]

I think maybe his point is that you're not any safer from the US government outside of the US.

A chain is only as strong as its weakest link

[voice_of_all_reason]

Cliche, yes. But true. Throwing up more doors is only going to add another layer of UI headache, and it won't do anything to address the issue of say, FBI agents losing their laptops in bars...(http://www.theregister.co.uk/2001/07/18/fb i_loses_hundreds_of_laptops/)

Re:A chain is only as strong as its weakest link

[wolfgang_spangler]

wow, you posted a link that states that British security services left laptops in bars. Good one.

Re:A chain is only as strong as its weakest link

[nasch]

What UI headache? And the article contradicts you on the lost laptop issue: "It can protect data when a person's computer or device is lost, stolen or hacked, for example." Could it be you... *gasp* ... didn't RTFA??

Re:A chain is only as strong as its weakest link

[TheRaven64]

The VM on my laptop is encrypted, as is my home directory. When I boot, a decryption key for the VM is stored in RAM. If the machine is turned off, this is lost and it is impossible (well, very hard) to recover the contents of the swap. My home directory key is generated from my password, which must be entered when I log in.

All of this encryption is done in hardware. I was considering, for my next laptop purchase, getting one with a MiniPCI slot that could have a crypto accelerator inserted (even a cheap one can handle over 300MB/s throughput, which is faster than my hard disk can do). Having this on-chip or even on the motherboard would be a huge incentive for me.

Re:A chain is only as strong as its weakest link

[hacker]

What vendor's hardware dongle are you using to make this work? I presume you're not using the onboard machine's/laptop's encryption chipset, so which one ARE you using? I'm curious to see how you're auto-generating the keys from an algo, without storing the nature of that algo on the system proper, prior to mounting your home directory... do tell.

Re:A chain is only as strong as its weakest link

[TheRaven64]

Sorry, type. It was meant to be 'all this is done in software,' and I would like it to be done in hardware. OpenBSD supports a number of hardware crypto devices, and I was thinking of getting one of the Soekris ones for my next machine, which could then be used to offload this.

My current machine is a PowerBook, and there are several weaknesses in the implementation of the security mechanisms, although the principle seems sound.

Ok, what are we talking about?

[DARKFORCE123]

This article is short on details about the encryption, and it says nothing at all about the current Homeland Security opinion on said technology. I sure know people care about having their data safe and that is a huge problem. Ask the FTC about that. Discussing this further without more facts could just be a waste of time. This is a simple technology "We done it!" announcement. Nothing more.

Re:Ok, what are we talking about?

[disposable60]

Makes me wonder how much 'assistance' IBM got from the NSA.

Re:Ok, what are we talking about?

[Ender_Stonebender]

The submitter is using "anti-Homeland Security" as a way of testing the intelligence of Slashdot users. See, this technology is (quite transparently) for digital restrictions enforcement*, which the general population of Slashdot is against. However, the general population of Slashdot is also against the invasions of privacy perpetrated (or attempted to be perpetrated) on US citizens by various agencies with "Homeland Security" agencies**; so the submitter is attempting to skew the conversation (and perhaps eventually general zeitgeist of Slashdot) in the direction of "encryption is good because it's hard to spy on us" and hoping we don't notice that a) it's (probably, haven't RTFA yet) not a publicly available algorithm that real cryptographic experts can examine for weaknesses and b) that we're not in control of what gets encrypted and what doesn't.

Hopefully all of you figured all that out before reading this comment.

--Ender

* Stolen from someone else's sig: "The key to stopping Digital Restrictions Enforcement is to stop calling it DRM." Or maybe it was some other phrase that could have been acronimized to "CRAP".

** A while back, I looked for actual references about the *federal* Department of Homeland Security pulling these stunts. All reports were either hoaxes (Mao's Little Red Book incident), or local agencies with similar names.

Re:Ok, what are we talking about?

[Trelane]

Makes me wonder how much 'assistance' IBM got from the NSA.

What, you mean like back when they were developing DES, and they got visited by the NSA? It went something like this (totally made-up, aside from the fact that the basic scenario happened):

IBM: So, this is our new crypto algorithm! Isn't it neat?
NSA: Yeah, neat. Umm, you should add a little something here. [points to a segment of the chart, indicating that they should include the "S-Box"]
IBM: But why?
NSA: Because. M'kay?
IBM: I guess. OK. [draws in the S-Box]

Then in the late 1980's, differential cryptographic analysis is discovered and, gosh, adding that bit as the NSA said helped prevent differential cryptanalysis from succeeding against it.

Lesson: The NSA isn't entirely evil. They employ some of the brightest mathematicians in the USA, and they use 'em to help the USA's citizens and businesses. This also trickles out into the rest of the world, to a (admittedly limited) extent. Notably, the "USA's citizens' and business'" interest is not always in the interest of other citizens and businesses (nor necessarily all), and politics are involved, so I'm not pretending they're saints either, particularly if you're from another country. But the point is that they provably do good--especially considering that the SE Linux project is sponsored by the NSA. (It's interesting to note that the wikipedia article on the S-box also mentions how people paranoid about NSA backdoors tore apart the S-Box too).

source: A LISA talk/tutorial on cryptography. The wikipedia links have information too.

Re:Ok, what are we talking about?

[Jeremi]

The submitter is using "anti-Homeland Security" as a way of testing the intelligence of Slashdot users. [...] it's (probably, haven't RTFA yet)

I see the results of the test are already coming in...

Re:Ok, what are we talking about?

[Albio]

"We done it" is better than "we think maybe hope we can in the next 5 years".

Of course it will be used

[Anonymous Coward]

If it works, content companies will lobby the gov like never before (picture hundred-mile-high stacks of dollar bills) for the ultimate DRM. Gov will say "no problem" as long as it has the customary back door to let the spooks in.

Good and bad:

[Anonymous Coward]

The good: it helps to protect your data -but for display output (your eyes need analog signals -well, unless you use some sort of VR goggles with ecrypted link)
The bad: it helps to protect, or MDR as it were (DRM), that which you might not have created but obtained (one way or another).
The nice: it does it on-the-fly (no, not the Spanish kind)

No problems ...

[erbmjw]

The article does not specify that the new technology would be under the user's complete control - in fact they even mention it could be used for DRM.

So essentially the {%please place the name of your bogie man here%} could get at your information even while the majority of users thought they were protected by this new technolgy.

Said

[Mark_MF-WN]

Who said they would have liked it? The Clinton administration was about as republican as it gets. But it's always the current administration that's under the spotlight. Don't worry -- if and when the Democrats next hold the presidency, everyone will rip them apart for stripping away freedoms as fast as they can. But until then, it's Bush and the cronies who are fucking you over, and so they're the ones that get all the criticism. Criticizing Clinton is, at this point, an exercise in political futility. He can't really do much damage at this point.

Re:Said

[Lord Kano]

The Clinton administration was about as republican as it gets.

Only if you don't know what Republicans are.

The Clinton administration was enthusiastically "Pro-Choice" and Anti-Second Amendment, quite the opposite of the Republicans. Clinton also passed a middle(and upper)-class tax hike. Once again, not very Republican of him.

LK

Re:Said

[MobileTatsu-NJG]

"But until then, it's Bush and the cronies who are fucking you over, and so they're the ones that get all the criticism. Criticizing Clinton is, at this point, an exercise in political futility. He can't really do much damage at this point."

I think the OP's point was that GWB doesn't hold the patent on evil. This is something to be mindful of. The next guy, democrat or republican, could easily be just as evil. If you just assume "Hey, it's not Bush! Our problems have gone away!", well then you're in a wee bit o trouble.

Re:Said

[stinerman]

I think we can all agree the Clinton administration might not have been Republican by today's standards, but buy the standards of yesteryear. Even by the outdated 80s standards, they weren't what you'd call a traditional Democratic administration either.

Re:Said

[AngelofDeath-02]

We're going well off topic but I feel this needs to be added to your statement. We may get someone just as bad/worse next time. The key however is to try someone else! Not that we get much choice, as Bush has already had his two terms.

Also, Isn't this the first time in a while that one party controlled the 3 parts of the government?

Re:Said

[rainman_bc]

Who said they would have liked it? The Clinton administration was about as republican as it gets.

Because in the US, calling someone liberal is actually an insult for some reason which I don't understand. The only options in an electiono are right wing, or more right wing. There's no party that's really middle of the road.

And while Dubya says he's a small c conersvative, he's actually more left wing than any other president. Sure he cuts taxes and believes in prayer in school, but his administration is protectionist, and it wants to control everything in the name of security. A right wing government would vehemently oppose protectionism.

Re:Said

[ConceptJunkie]

I think the OP's post is that if you compare Clinton's and Bush's administrations against what the Republicans purport to stand for you will see that the difference between the parties is far less than the difference between either party and the traditional small-government, pro-individual-rights, pro-individual-responsibility ideals that Republicans used to stand for. In that respect, I would agree with the OP.

Aside from being proactive (although not very competently) in foreign policy and passing a tax cut, I haven't seen anything "Republican" coming out of the White House or Congress in years. Oh, wait, some good Supreme Court judges got appointed. OK, that's 3 things in 6 years, compared to spending that makes the Democrats in the mid 60's look tame, passing huge entitlements to everyone who can rent a lobbyist and treating Mexico as the 51st state (or more accurately, the U.S. as the new Mexican state), the so-called "Republicans" in charge aren't something I would recognize as such, and completely failing to reform anything.

Re:Said

[EmagGeek]

The first time since the first half of Clinton's administration - if by 3 parts of government, you mean the house, senate, and presidency. Of course, there is the supreme court, but I don't have that info fresh in my mind right now.

I think there is something to be said for the fact that two years of Clinton were bad enough to swing the country so far to the right. I'm convinced that if the R's had put someone up against him in 1996 that wasn't 200 years old and had one foot in the grave, Clinton's office would have come to an abrupt end much earlier.

BTW: I still think the SCOTUS justices should be elected... life terms, sure.. but they should still be elected. I think it is wrong to have so many aspects of our law decided by unelected officials.

Re:Said

[Anonymous Coward]

Don't forget the bombing of the USS Cole where the officers were ordered to stand down to the little boat with explosives,
Madeliene Allbright and the visit to Korea to sell nuclear secrets,
the whole Los Alamos fiasco,
Universal healthcare BS,
Using Marines as waiters (Hillary did that),
the social experiement which includes "Dont's ask, don't tell",
tax hikes (mentioned),
recession when left office,
etc

Re:Said

[KBAegis]

Well, here's where I disagree. Over the last 150 years, the parties have become more and more liberal, with the expansion of powers. The etymology of the term 'conservative' referred to 'conservation' of government. So from that standpoint, yes, I agree with both of you when stating that both parties have become more liberal. This includes the audacity of the federal government legislating things like marriage. As for the definition of "republican" that the afforeposted was using, it should've read more closely to libertarian. He was basically using an archaic expression in a contemporary environment, which creates a flawed comparison. Since the post-Roosevelt era, the definition of 'republican' has become economically conservative and socially liberal. The term 'democrat' has ironically become economically liberal and socially conservative. In that sense, both congress and the white house have been outstandingly 'republican,' and Clinton was unable to fit the bill (literally) and so while he could live up to the socially conservative criterion, he was unable to create effective policy by remaining economically liberal.

Re:Said

[c_forq]

BTW: I still think the SCOTUS justices should be elected... life terms, sure.. but they should still be elected. I think it is wrong to have so many aspects of our law decided by unelected officials.

I have to highly disagree with you on this fact. The SCOTUS needs to be as separate from the masses as possible, I think if they were voted in you would have segregation mandatory, abortion completely illegal, sodomy in the books as a felony, ten-commandments in every classroom and maybe be living in the United Christian States of America.

Re:Said

[Mr. Mindless]

repulicans socially liberal? are you insane?

backing anti-gay-marriage amendments, anti-choice, trying damn hard to get the church into the state - and only one church in particular...

that's socially liberal?

killing sex-ed programs because they will encourage premarital sex?

defintely socially libaral...... yeah.

today's republicans are southern white christians doing everything they can and spending every dollar they can to bring our country to their view of perfection, which mimics their conservitive christian backgrounds.

Re:Said

[rainman_bc]

The only difference I see is the Dems support seperation of church and state; the Reps support the church values governing the US.

Re:Said

[rainman_bc]

And yet that's where the majority of votes go - to the southern cross right wing freaks.

IMO it's your own fault for having a 55% turnout at the polls, and the President thus represents on 27.5% of the popular vote...

If 45% percent of your population is indifferent towards who is in charge, it's your own fault and you (as a country) deserve what you've got.

Re:Said

[mOdQuArK!]

he's actually more left wing than any other president.

Nah, he's right wing, but it's more of the Benito Mussolini fascist government right-wing direction instead of the Liberterian less-government right-wing direction.

(Whoever was responsible for reducing the description of anyone's political views down to a simple left or right direction has really done a lot of damage to the possibility of diversity in our public discussions.)

Re:Said

[C0vardeAn0nim0]

protection has nothing to do with being left or right wing. the last military dictatorship in brasil, that lasted from 1964 to 1985, was a far right government and they were protectionists. most imports were forbiden, brasilian agriculture had several subsidies, and other stuff.

this kind of protectionism has nothing to do with being left or right. it has more to do with the oposing forces represented by populism (do things that apeal to the public. screw common sense) and pragmatism (do sensible things that work on the long term, even if they're initially unpopular). this is just my opinion. feel free to disagree or point mistakes in my interpretation.

Re:Said

[Anonymous Coward]

Don't worry -- if and when the Democrats next hold the presidency, everyone will rip them apart for stripping away freedoms as fast as they can.

Like they did in the 1990s?

Oh wait: many of the people complaining about loss of freedom now couldn't kiss Clinton's ass fast enough back then. As long as your guy is the one in power trampling over people you don't like, anything goes, right?!

"We can't love our country and hate our government."

"But I also know there have been lawbreakers among those who espouse your philosophy."

"But do not condemn people who work for the government. That's the kind of mentality that produced Oklahoma City."

Re:Said

[Anonymous Coward]

Christ, one mention of politics and a whole thread goes waaaay offtopic. The topic is Encryption-On-A-Chip, not Dems this and Repubs that.

Re:Said

[rainman_bc]

According to this, American Conservativism isn't clearly defined, although IMO part of conservatrivism is free, open market Laissez-Faire operations, of which protectioniam isn't a part of...

Re:Said

[Anonymous Coward]

BTW: I still think the SCOTUS justices should be elected... life terms, sure.. but they should still be elected. I think it is wrong to have so many aspects of our law decided by unelected officials.

Disagree about electing them. But they should be term-limited (10 - 20 years).

When the constitution was written, life expentancy was less than it is now.

Re:Said

[cnerd2025]

Also, Isn't this the first time in a while that one party controlled the 3 parts of the government?

Nope, in 1993, when Clinton took over from George HW Bush, the Legislative, Judicial, and Executive branches were all under control of the Democrats. Needless to say, the Dems made a few mistakes, and the Republicans, rallying behind Newt Gingrich, took control of the House of Representatives, a feat that many Americans (even Republicans) didn't believe would happen for a long time. Remember their plan was called the "Contract with America" (which Clinton referred to as the "Contract on America"). The Republican House passed a lot of good bills, and actually gave Clinton the opportunity to pass some much more moderate reforms (such as the much-needed welfare reforms). So the answer to your question is, "no, from January of 1993 to January of 1995, the Democrats controlled all three branches of government."

It should also be noted that true conservatives favor less government, whereas true liberals favor more government; they both believe that each of their respective paths are conducive to effective interaction between people. Unfortunately in America, the lines have become somewhat blurred: a Republican believes that welfare and affirmative action should be eliminated, but also believes that abortion should be stone cold illegal. A Democrat believes that institutions like the SEC and FDA should exist to provide impartial mediation between people and/or corporate entities, but also believe that killing an unborn fetus (which may have the rights to "life, liberty, and the pursuit of happiness") is perfectly alright. It's a touchy line in politics, and people don't really realize how they are being duped by the system. Case in point: a Republican leadership conference in Tennessee recently featured prominent Republican Senators and Representatives, all of which called for fiscal conservativism. However, of those who spoke, John McCain is perhaps the only Senator who is in reality a fiscal conservative. With a Republican House and Senate, we would think that fiscal responsibility would follow. In the words of (conservative) columnist George Will, the current Republicans pay only lipservice to the neoconservative agenda, but act as big-government, heavy-spending liberals.

Now for my disclaimer: I am not a fan of Dubya at all. I was a fan of Clinton. Dubya has made so many mistakes on so many levels, I think even the ultra-liberal John Kerry would have actually done a better job. Bush is just awful. He is eroding liberty and freedom and democracy in their very names. He is continuously lying to the American people and to the World and immediately smears any percieved opposition (i.e. smearing McCain in South Carolina during the 2000 electoral campaign). He has no concept of fiscal conservativism except the words "tax cut", which is perhaps the most irresponsible fiscal action one can take. At least the democrats will fund their big-government projects with interest-free money. I have the satisfaction that this November (210 days from April 10, 2006, for those who are counting) there will be bloodshed in Washington, DC. Bush is a slimy politician and a horrible person. He should be held responsible for his misdeeds and his inaction if he is truly concerned with "democracy" and "liberty".

Re:Said

[hackwrench]

It's not so much that we don't care who gets in as much as we would prefer that all of those with the resources to do so didn't. But there isn't a mechanism to stop that, so we're in trouble.

It's like the scenario in The Hitchhiker's Guide to the Galaxy:

Their planet is ruled by lizards.
So the people are lizards?
No the people are people. The rulers are lizards.
So why do the people vote for them?
They want to make sure the wrong lizard doesn't get in.

Except the thing is that it shouldn't be a lizard in power but a person so no matter who they vote for they lose.

While I can't speak for the entire %44 percent, in America right now, that's the way it is for a great many people- no matter who you would vote for, you'd lose big with an inperceptible difference no matter who you pick, so why tie up resources to vote?

Re:Said

[iminplaya]

Criticizing Clinton is, at this point, an exercise in political futility. He can't really do much damage at this point.

But SHE can...

And repairing those computers?

[s0l3d4d]

And what will happen if you will replace the logic board of those computers? Will all your data be gone even for you?

Re:And repairing those computers?

[TheRaven64]

If I were designing the system, I would store the key in RAM. It would be a hash of a pass-phrase entered at boot, and could be flushed in software. If you replace the logic board, you simply enter the pass phrase again.

Re:And repairing those computers?

[City Jim 3000]

I believe the data is encrypted by some key, like a "password"...

Also, this chip is merely an accelerator, probably some kind of DSP. RAM, filesystems etc can be encrypted in software, the downside with encrypting RAM in software is that you have to store the unencrypted key in the same RAM.

Re:And repairing those computers?

[AzsxQuii]

I agree that repairing units with the technology could be a PITA. I can think of imaging software which will make the restoration process a problem. Much like the way XP bitches when you change significant portions of your computers hardware. Lastly, if the OS is not designed to take advantages of these things they will be pretty useless.

Maybe negative, but in a different way

[towsonu2003]

Secure Blue by IBM will keep users' data encrypted and secured at virtually every moment on essentially anything in which the chip can be used. ... This has to be considered decidedly anti-Homeland Defense by the current administration.

I don't get the reference to Homeland Security? Is this the result of the newest US social scare, or is it really relevant?

Anyway, this could be bad news in two ways:
1. It will be used for DRM for sure
2. You won't be able to see what's going on on your employee's computer (which is good news for the employee)

But how does the Homeland Security gets injected into this issue? I mean, will some poor encryption (of which the specs can be supoeaned under the patriot act) stop the Department of Homeland Security from getting into our hard drives and data? I wish someone could clarify this...

Re:Maybe negative, but in a different way

[Anonymous Coward]

Some people just like to throw in irrelevant political commentary into everything they say, because they are morons.

Re:Maybe negative, but in a different way

[Anonymous Coward]

Where does it rule out that there would not be any sort of Security Management feature? id est that there be no way for managent to see/get at/retrieve data? It would seem absurd for management not to have "final data retrieval rights/method" somewhere somehow available. It's simply imperative. Oh, you mean the just off and and you have no way whatsoever to retrieve your data? Oh, too bad, really, I feel sorry for you, but you had one of those indefatigable, unvaquished, invulnerable Secure Blue chips you understand and your data will be forevermore gone, just forget that you ever had them. Ihey now a non-entity. They, your ex-data, are a mere memory...

Re:Maybe negative, but in a different way

[Anonymous Coward]

I mean, will some poor encryption (of which the specs can be supoeaned under the patriot act) stop the Department of Homeland Security from getting into our hard drives and data?

Uh, who cares if they can get the specs or not? IBM do have proper cryptographers (e.g. they did the Mars AES finalist algortithm). Knowing how a strong crypto algorithm works does not instantly tell you the encryption keys :-p

Re:Maybe negative, but in a different way

[TubeSteak]

But how does the Homeland Security gets injected into this issue?

Drug dealers, organized crime &/or terrorists would find this technology very appealing.

Not just terrorists, but any foreign government really. Saddam & Osama both would have benefited from hardware level heavy duty encryption, as the U.S. has gotten computers from both of 'em that were completely unencrypted, yet contained sensitive information.

Re:Maybe negative, but in a different way

[jbolden]

Most (all?) security schemes don't work well against against someone being able to
1) take physical possession of your computers
2) hold your employees at gunpoint
3) cross check against physical assets
4) be able to repeat as often as needed

Re:Maybe negative, but in a different way

[dr_dank]

2. You won't be able to see what's going on on your employee's computer (which is good news for the employee)

I'm sure there would be some kind of key escrow or a known seed to generate the passphrase if not for the surveillance aspect, but for support. It wouldn't take long at all for the first support call to come in for a forgotten passphrase. What would you tell the client, the data is gone with no hope of recovery?

Re:Maybe negative, but in a different way

[Saint Facetious]

2. You won't be able to see what's going on on your employee's computer (which is good news for the employee)

I'd imagine that on employee computers (depending on the company, of course) the setup of the encryption would be done by the systems admin. On my work PC, the worker has little ability to do anything as it is.

Don't know about cnet

[bigberk]

But I looked through the IBM Press Room and didn't see anything about this technology. Why post a story about "IBM planning to release on Monday..." when you can just wait for a real release from the company to happen. At the moment I'd like to share this info with colleagues who do research in hardware security but can't find a good source to send them to.

Effective in Embedded Systems?

[zolaris]

So if I understand this right they are putting an encryption module in what is effectively an embedded system (or could be an embedded system). Now encryption in embedded systems has some problems. Namely they are trivially defeated because the key has to be stored in clear text, on the system. So they keys are usually easy to find since they have to be stored somewhere in clear text and have a pointer to them, also in clear text. Now this would be a DMCA violation to break it but I don't think that would stop anyone bent on doing something illegal anyway. Now I might be wrong about this, since these could be networked systems in theory but I see this being applied to things like media center boxes. I know that these often are networked but what happens in a network outage or any disruption in service? I can't access my entire hard drive because it's encrypted? That doesn't make sense to me. I don't know about anyone else but every ISP I've had has had SOME connectivity problem. I see this as another area where legitimate users may feel the need to 'break' DRM just to get something to work right and get the product they paid for.

Re:Effective in Embedded Systems?

[jbolden]

I don't know about this chip but on the thinkpads that wasn't the case. The chips were able to perform one encryption/decryption without actually knowing the proper prime (hardcoded). Lets assume they used RSA to make this easier:
the chip knows pq, e. M^e is encrypted and (M^e)^f is decrypted. The chip has the (^f) function (mod pq) hardcoded in. It doesn't actually "know" f.

Lets say your harddrive is encrypted, there are 3 primes needed to be known to get to it:

one is generated by a pass-phrase
one is stored on the harddrive (encypted using the chips built in)
one is stored in the chip (semi permanent)

Only by using the chip can you read the hard drive.

Re:Effective in Embedded Systems?

[shmlco]

"Namely they are trivially defeated because the key has to be stored in clear text, on the system."

From TFA: "Millions of laptops already contain a chip called a Trusted Platform Module, or TPM, which offers protected storage of encryption keys, passwords and digital certificates."

Re:Effective in Embedded Systems?

[zolaris]

I am aware they do contain all of this essentially on the system but I am skeptical that someone much smarter than I am might be able to use this and similar techniques to defeating encrpytion in an embeedded system to defeat it. I'll admit that it is NOT trivial to do but might not be all that difficult.

Debugging & Breakpoints

[CockMonster]

How's this going to work? hehe, How long before we buy our PCs from China?

Leaker in Chief

[Anonymous Coward]

Yes, but only the current administration is guilty of illegal domestic surveillance for political purposes. Sort of like a leak isn't a leak when it's secretly authorized as a leak, right?

Re:Leaker in Chief

[Lord Kano]

Oddly enough, that describes the last President too.

LK

Re:Leaker in Chief

[Trigun]

Clinton's leak ruined dresses. Bush's ruined lives.

Re:Leaker in Chief

[Anonymous Coward]

There never was a dress. That was a bluff. But it is interesting that Republicans like to change the subject of Bush's brazen breaking of the law whenever they can to Clinton's sexual indiscretion. One seems a little more important than the other. Like lying to get the American people to support a war.

Re:Leaker in Chief

[cayenne8]

"...the current administration is guilty of illegal domestic surveillance for political purposes."

"...that Republicans like to change the subject of Bush's brazen breaking of the law whenever they can to Clinton's sexual indiscretion."

I think the earlier poster that said the previous administration had something in common with the current one wasn't to do with the Lewinsky thing, but, more so the finding of FBI files of Clinton 'enemies' in the whitehouse...I think they were in Hillary's office?

I'm not sure on the Hillary office finding, but, I do remember there being a stink as to why they had FBI files on private citizens not under investigations for a crime in there...surely for political purposes?

This isn't meant to protect you from the gov't

[Anonymous Coward]

This technology is clearly meant to keep consumers from getting to data they (thought they) bought. If every link in the chain is encrypted, right up to the tamper proof screen and speakers (which will destroy their keys as soon as one attempts to open it, rendering them useless), digital copies of protected media aren't possible anymore.

One small step for IBM, one giant leap for DRM...

However, there's still hope: making tamper proof hardware is very difficult. Making hardware that's not vulnerable to side channel attacks is extremely difficult. And lots of existing cryptographic systems are weak due to misuse of the cryptographic building blocks (think WEP for example). And then there's the weaknesses that are introduced on purpose, to satisfy certain three-letter agencies.

no back door?

[argoff]

...This has to be considered decidedly anti-Homeland Defense by the current administration. If so, when will we see it if ever?"

Well, unless I can varify the code or make the chip from a copy of it's mask myself - I am pretty much taking it on faith from IBM that it is secure from the eyes of the government. (no offense IBM, but I prefer the security of open review) Untill independent sources can take the chip and put it under an electron microscope and say: Yes it's designed secure - then it's pretty much not secure. An if it's firmware that can be re-programmed, then it is especially not secure if the governments hands get on it anywhere in the distribution chain.

Hard Drives?

[InvaderSkoodge]

I would like a gadget like this that plugs between my motherboard and hard drive and encrypts all the data going to the HD in real time, transparent to the OS.

Re:Hard Drives?

[Anonymous Coward]

Such a gadget exists. It's called NTFS.

Re:Hard Drives?

[Anonymous Coward]

They exist, eg http://www.flagstonesecure.co.uk/stonewood_flagsto ne.aspx

Patching exploits?

[agent dero]

And what happens when something is exploited...?

The question with encryption is never if but always when it will be hacked.

Oh well, I'd guess you'd have to buy newer hardware without the exploit (but with the backdoor of course)

No processor overhead.

[Chas]

Hey man. What's that encryption on that thing?

Double ROT26.

Woo. That's gonna be TOUGH to crack!

Re:No processor overhead.

[Ninjy]

They should just use double ROT13, then. It would double its processing capacity!

Re:No processor overhead.

[noidentity]

Damn, I wish I could read your post, but you seemed to have double ROT13'd it.

Can't develop/sell security products in Amerika ?

[BadassJesus]

This has to be considered decidedly anti-Homeland Defense by the current administration. If so, when will we see it if ever?

What the hell that statement means ? I can't develop or sell security products like encryption in Amerika without some big brother green-light or what ?

Not new....

[Chanc_Gorkon]

They have had this for sometime now on mainframes. The biggest reason this is is alot of mainframes for a long time did not even have floating point processors! They had a separate chip to do any encryption. The application of it in this case IS new and it looks like, to me, that the OS has to have a driver for the chip and will have to be written such that it can decrypt the data on the fly. No easy task.

Re:Not new....

[TheRaven64]

Hardware encryption has been around for a long time in PCs. You can buy crypto accelerators (PCI or MiniPCI) that support a throughput of around 200-500Mb/s. Soekris make some nice ones, fully supported by OpenBSD and FreeBSD, with Linux support under development.

Hardware breaks?

[ThePolkapunk]

What happens when your hardware breaks?

"Sorry, you're data's gone, we don't have copies of the private keys. Looks like you need to pay a hacker to crack the data for you."

Re:Hardware breaks?

[kimvette]

<**AA, BSA, etc.>Oh that's easy. Buy another "license" to play the game, listen to the music, or watch that video. </**AA, BSA, etc.>

Encrypting harddrives

[Anonymous Coward]

A good use for a technology similar to this would be harddrives with embedded crypto. When you boot your laptop, it would ask you for a passphrase. This passphrase is used to create a key (by using a hash function).

Your harddrive automatically and transparently encrypts and decrypts everything that's on your harddrive with this key. So unless you enter the correct key, your system won't boot, as the computer will see seemingly random bits on the harddrive.

So if your laptop gets stolen, no more worries about stolen data!

Profit!

[magetoo]

How's this going to work? hehe, How long before we buy our PCs from China?

Another scenario for the conspiracy theorists:

1. Implement legally unexportable cryptographic algorithm in hardware.
2. Lobby for said algorithm/hardware to be mandated for government agencies' equipment. (because it's about homeland security, you know)
3. Profit!!!

Or something like that...

Keys too or only algorithms?

[quentin_quayle]

Apparently what they're putting in the chips is, at least, encryption/decryption routines. Aside from the obvious questions (what happens when you want to change algorithms?), the important question is whether they're including digital keys as well.

The single factor that makes "trusted computing" evil is that there's a digital key (the "attestation" or "endorsement" key) baked into the TPM which the owner of the machine is prevented from accessing or changing. If all the keys were accessible to the owner, it would be a purely beneficial technology. With the anti-owner feature, it becomes an engine of DRM, censorship, and vendor lock-in on a vast scale, and at a fundamental level absolutely prevents security and privacy for the computer owner.

So the question is which category this IBM tech falls into. And that in turn depends on whether digital keys will be baked into the processor, or whether it's only a set of routines that any software can use under the owner's control.

Re:Keys too or only algorithms?

[Anonymous Coward]

Holy shit, a sane voice commenting with a legitimate question on Slashdot? Apparently you're new here. This is a violation of protocol, you will be fined appropriately.

Re:Keys too or only algorithms?

[Kaptain_Korolev]

Both,

Presently people trumpet crypto algorithms, AES is better than Twofish, 3DES is crap etc etc etc. All of this is moot though when the greatest vulnerablility in the system is the attacker scanning memory for keys and ciphertext. This isn't all that difficult when you consider that most keys will resemble random byte arrays, and good ciphertext should effectively be pseudo random. .

What this technology does is make sure that what you find in memory is not the key, or the data, but rather an un-transformed version of it which must have a hardware alogorithm applied to it in addition to the base cipher. NB: Many of these techniques are already applied through software cipher and data obfuscation.

If the user can change the keys, what's the point? Yes they should be able to change some keys, there own for example, but not the trusted signing authority. It's back to the big PKI nutshell. How the hell do you share and authenticate keys! At the end of the day there has to be a trusted source, TPMs seem the best way of doing this to me.

And to the person who said 'this will be hell to debug'.... That's the point!

Re:Keys too or only algorithms?

[plasmacutter]

The TCG/TCPA/(insert new name here to throw off savvy techies looking to warn the public) considers a lack of user access to keys essential for 'enterprise' level security.. (in other words whistle blower prevention).

The support for policies which treat the computer's owner as the attacker/threat is obviously supported for the sake of DRM.. I have seen the proposals the EFF has filed with TCG/TCPA central committees. They are reasoned and compromising.. and are ignored. In 2003 when this was first brought up that facade was believable. They have now had roughly 3 years to look at this issue, and it seems incomprehensible they would come to a different conclusion. Logic simply dictates otherwise.

They exist to sneak in a draconian new DRM infrastructure under the ruse of security, and everyone in power believes them. I only hope the hackers can provide enough fortitude to withstand this next and hopefully final assault on the freedom and versatility of the personal computing platform.

Re:Keys too or only algorithms?

[swillden]

The TCG/TCPA/(insert new name here to throw off savvy techies looking to warn the public) considers a lack of user access to keys essential for 'enterprise' level security.. (in other words whistle blower prevention).

Actually *all* real crypto hardware considers lack of user access to keys essential for security, not to prevent whistleblowers, but because the only way you can really be certain that the key isn't exposed where an attacker can get it is if the hardware will never give it up to anyone at all. After all, the attacker may be an administrator with full access rights -- and if I'm the administrator, I want the device to refuse to hand over the keys just so that no one can claim I took them and misused them.

Whether or not there's any non-DRM use in putting such hardware in home users' PCs is another question, of course.

Re:Keys too or only algorithms?

[swillden]

The single factor that makes "trusted computing" evil is that there's a digital key (the "attestation" or "endorsement" key) baked into the TPM which the owner of the machine is prevented from accessing or changing.

To be accurate, the problem isn't that the user can't change it, because that wouldn't prevent its use for DRM -- if you changed it your machine would just be unusable for DRM'd content, same as if you just refused to use players that cooperate with the DRM scheme or buy/download DRM'd content. The problem is that you can't read the key value.

If you could read the key value, though, that would make the whole attestation scheme completely worthless for enterprise systems where it is, in fact, valuable. With that feature, an administrator can verify that an security-critical server is in fact running the OS and apps that it is supposed to be -- and there's really no other way to do that.

So the real question is not why the key isn't changeable or readable, because there are good reasons for those, but why the technology is being put in PCs intended for consumers.

ROT52

[magetoo]

Triple-ROT52? +3 Informative? Shame on you, moderators.

Re:ROT52

[thrillseeker]

Triple-ROT52? +3 Informative? Shame on you, moderators.

You have to remember - thre's no technology-IQ test to get a slashdot account or become a moderator. In slashdot's defense, the odds (seem to be so far that there) will be some moderator who recognizes the subtle humor and moderates appropriatley. To end users, the "right" answer will probably eventually appear.

Re:ROT52

[magetoo]

In slashdot's defense, the odds (seem to be so far that there) will be some moderator who recognizes the subtle humor and moderates appropriatley. To end users, the "right" answer will probably eventually appear.

Point taken.

Also, a couple of my comments just got modded up, so I have to agree. :-)

Re:Can't develop/sell security products in Amerika

[Lord Bitman]

Yes. You can't develop encryption without homeland security going after you.
Of course, you can't develop an unencrypted system without the RIAA going after you.

The definition of "available"

[Beryllium Sphere(tm)]

"IBM has built a prototype of Secure Blue using its own PowerPC processor technology. However, the system will work with any processor design, including those from Intel and Advanced Micro Devices that are used in PCs. An IBM representative said the company has not had discussions with Intel or AMD on including Secure Blue in their processors."

IBM or Lenovo?

[micromegas]

Who is doing this, big blue or PLA?

Re:IBM or Lenovo?

[santaliqueur]

lenovo only bought the pc division from ibm. so lenovo will have nothing to do with this project.

Big deal.

[Anonymous Coward]

If there's a demand and a US company doesn't meet it, it means that a foreign company will. Remember when ITAR restrictions were relaxed for cryptography? Governments didn't like its proliferation, but the horse had bolted anyway. Besides, business can out-lobby homeland security concerns, and if someone wants your data badly enough, they'll start by cutting off your toes.

Closing the analog hole

[Sir Holo]

It sounds like this is aimed at closing the analog hole, rather than at protecting users.

nice job selling DRM

[penguin-collective]

These people are less likely concerned with your security and more likely concerned with making it impossible for you to get at the bits of digital media content; that's because right now, you can still capture digital audio and video if you know where to look in memory.

Debugging

[jfclavette]

Seriously, reading that core dump won't be easy...

Hard Drive encryption

[fontkick]

On a similar topic, Lacie released a portable hard drive with built in encryption (Triple DES) and a fingerprint reader.

It probably won't protect data from the govt (assume they can read anything), but it's a good idea if you travel and need the capacity.

http://www.lacie.com/products/product.htm?pid=1069 1

Re:Hard Drive encryption

[Anonymous Coward]

An interesting titbit from the lacie encrypted hdd:

"Regarding the SAFE drive, the key is stored in the SDRAM memory. Thus, it is almost impossible to access - except of course for authorized governmental organizations if requested."
http://www.lacie.com/download/more/whitepaper_safe _enc_en.pdf

Re:Hard Drive encryption

[PitaBred]

then put your own encrypted filesystem within their encrypted filesystem. Everyone's a winner ;)

HDTV camcorder ban?

[tepples]

At some point the data-stream needs to be decrypted and presented to the user and at that point the data is no longer secure and subject to being copied.

Unless the government restricts the importation or interstate sale of high-resolution digital video cameras and/or imposes a prohibitive excise tax on otherwise unregulated sales.

Until monitor/speaker/etc manufacturers decided to allow encryption in their hardware

What is HDCP other than encryption inside a monitor?

Ironic, isn't it?

[Spy der Mann]

Hardware encryption - bad
Hardware DRM - good

Since when "homeland security" became Big Brother? :(

Re:Ironic, isn't it?

[Anonymous Coward]

Indeed it is...

One thing that hardware encryption fails to realize is that it still doesn't secure what's actually being attacked.

Because this encryption is hardware-dependant, any older computers without this SecureBlue need to be able to network with newer machines using SecureBlue. That in turn means network data won't be any more encrypted than it ever was. That in turn leaves any data sent over a network and/or the internet every bit as vulnerable as it is without SecureBlue.

This is the important point about hardware encryption. Because it isn't backwards-compatable, and it costs people money (in the form of new motherboards which often times cost more than the computer itself is worth) to use the benefits of SecureBlue over a network, it'll take 10 years or more for it to gain wide enough acceptance and use to replace the current, unencrypted network systems.

In plainer english, these chips can be easily rendered worthless with 10 dollars of cheap (or should I say cheaper?) hardware. You buy a 4-port RJ45 box and cross the wires so that data keeps going through, then just take your own laptop and plug it in, and any data passing through is yours. Then again, why bother with that when you can simply get a program lke Cain & Able and let software defeat it for you for free? The ways in which this can be circumvented over a network are endless.

In recent studies, over 80% of all money gained or lost from the stealing of information from a computer was done remotely, without ever touching the computer itself. The average laptop sells for around 860 dollars. The average bank account number sold on he black market by hackers, even if there's no money in the account, goes for around $5800. Hackers can either risk a much higher chance of being caught for less gains by physically stealing the machine, or do it remotely with less risk and far more gain. You do the math.

Data encrypted in RAM?

[cdn-programmer]

That might make debugging a little more difficult.

Re:Data encrypted in RAM?

[droopycom]

No.

Obviously the cpu, and your debugger still see the same data. Theres just a big encryption/decryption block on DRAM bus.

The interesting thing though, is what cipher they are using, that allows random access to anywhere in the DRAM ciphertext to be decrypted. (Not your trusted AES-CBC for sure)

Hardwired encryption?

[Jordan Catalano]

Janek must have figured out a way to solve those problems without the key, and he hard wired it into that chip!

Re:Hardwired encryption?

[zoloto]

That's not a code breaker, it's *THE* code breaker

hows this differ from tpm

[Shades of Insanity]

So, is this just IBMs version of the TPM? I thought the TPM can be used to encrypt/decrypt entire filesystems as well.

Since when?

[mcc]

Not one that relies on draconian hardware chips that prevent you from having control over your computer.

I'm sorry, what? According to wide report, as of the new Intel macs, Apple is in fact using draconian hardware chips that prevent you from having control over your computer, and is reportedly using these specifically to keep you from running OS X on unauthorized hardware. (Though, hilariously enough, that's according to wide report. There is no hard evidence I've seen one way or the other that these chips are or aren't even in the new macs to begin with! All reports of TPM in the Intel macs are based on sort of circumstantial evidence from reports of the developer betas of the Intel macs. Since the actual release of the Intel macs, everyone has gone silent on the subject, and Google doesn't turn up any attempts I can find to take apart the Intel macs and the kernel to see whether TPM is in there. Apparently though the slashdot and tech blogger crowd were angry and opposed to Palladium/TPM for three or five years nonstop since it was announced, they just fell silent once they saw how shiny the new iMacs are.)

You are of course correct that they aren't, of course, using these chips for iTunes or the iPod. Yet. But if the chips are in the machines, they could start using them for such purposes at any time. The iTunes DRM already subtly changes with each iTunes version (the jHymn backup utility still doesn't work with the iTunes 6.0 DRM).

Though all of my computers since I was six years old have been Apples, if it's true that Apple is using TPM in their machines now, it would seem I'm going to be using Linux from now on. I was rather annoyed at the prospect of having to suffer a hardware platform transition (again) to begin with, but I can at least understand the reasoning behind that. But I'm absolutely not willing to pay for a computer if there's this ticking TPM time bomb buried in it that means, if someday the OS vendor changes their mind, a single OS update could sweep through and my computer would no longer be mine.

Re:Since when?

[GreyWolf3000]

You are of course correct that they aren't, of course, using these chips for iTunes or the iPod. Yet. But if the chips are in the machines, they could start using them for such purposes at any time.

In which case my point will no longer hold. But, currently, Apple's DRM scheme isn't nearly as bad what the orignal parent was talking about.

Re:Since when?

[plasmacutter]

Right with you there!

I had the luck to have had a windfall a mere month before that rediculous intel announcement. I knew intel had been deep into TCPA and immediately went out to buy the most powerful PPC based machine I could.

I will be sitting on this ppc machine for at least 4 if not 6 years, no matter how people make fun of it due to their precious "mactels".

As for the including of TPM's in apple machines.. one can extrapolate from the osx86 project that it is still there. There seems to have been no real change in the underlying authentication architecture to my knowledge.

It's evolution

[SlappyBastard]

As people try harder and harder to control your information, those who seek to avoid that control are going to push that information into vaults and underground.

My main fear is that the better part of the internet is going to be pushed underground because the gov't wants to read your email and the corps want to charge Google for letting you search for anything.

If these people get their way, there will be no incentive for intelligent people to use an above-ground internet.

There is a market

[Mr_Blank]

Regardless of whether Homeland Security likes it or not, there is definitely a market for the technology. In fact, the government (of the people by the people) might even mandate such technology directly or indirectly by punishing companies for allowing consumer data to be stolen. In a reasonable world the government (of the people by the people) shouldn't need too many more stories like the Fidelity data loss to start trying to legislate solutions to the laxity of companies around security. Another option is that market forces push companies to tighten security: eg HP threatens to quit using Fidelity services unless security is tightened. Either way, legistation or market forces, there is a growing market for this technolgoy.

Re:Can't develop/sell security products in Amerika

[wk633]

I don't see how it's anti-Homeland Defense. I mean, IBM did put in the backdoor, didn't they?

Never forget, the Clipper chip was on Clinton's watch.

Ah, yes.

[jd]

That's an extension of the Russian Vodka GutROT-105% algorithm.

Buy a Thinkpad

[Gates82]

While this does not encrypt the data on the HD the BIOS on my Thinkpad has several level of password protection and one is to protect the Hard Drive. If the password is enabled and I plug the drive into another system it shows in the BIOS but is not mounted by windows. You can't even see the drive in disk management.

Now there may exist easy work-arounds, but I am not to concerned about being target by someone who knows what they are doing. The people who want to steal my stuff are just trying to resell the hardware for their next hit. Just want to make it frustrating for the morons who steal.

--

So who is hotter? Ali or Ali's sister?

Re:Buy a Thinkpad

[Anonymous Coward]

Or an HP or Compaq. My Presario R3430 has "DriveLock" where my laptop won't boot without that password. The hard drive won't boot either, in my system or another system (typing in the password more or less cuts on power to the HDD and then checks the boot sector to see if it's right, before booting in my machine, and the boot sector refuses to boot in any other machine).

On my system, I've got it setup fairly securely. It requires both the boot and drivelock passwords to boot. What's more, those two and the BIOS Setup password are all different, with none being dictionary words. As an added layer of security, I have floppy, CD, and network boot all disabled. To boot from the CD for rescue operations, I can go into system setup and enable booting from the CD, and re-disable it after I'm done. This keeps people from booting from a CMOS clearing disk.

In theory, the only way to get to the data on my hard drive is to take it out and put it into another system. The only problem with that is that I've (accidentally) rounded out the screw. It woud have to be either machined or pryed out, and that risks damaging the drive. My theory is that if someone is willing to do that much work to get to my data (nothing more valuable than a few serial numbers from work in an encrypted zip file and encrypted word doc on a linux system...and a picture of my grandfather) then I'd probably pay them to see them do it once they're in prison.

Then again, as my other comment says, hardware encryption will do nothing in the first place due to backwards compatability issues on networks, so this is all realitively stupid anyway.

Interesting Indeed

[Schmendric]

It is good news indeed to see new support for hardware encryption. VIA has offered hardware encryption for some time now, including a very nice Random Number Generator. It's Quantum even. I just hope IBM has a performance increase similar to that of VIA. A lack of backdoors would also be a plus.

Pritti, pritti securatay!

[Opportunist]

Encrypted in Ram. Ok, I am not that paranoid, but maybe one of the paranoid people here might answer me how the HELL this should "increase my security". I can see the benefit of an encrypted HD. But Ram? Where do I gain securty from encrypted Ram?

Unless I'm a content provider, of course, and don't want my customer to read it properly. Who're they trying to fool here?

Re:Pritti, pritti securatay!

[dnaumov]

You enter some codes to access an online bank or a login/password to a company site containing vital data. Do you think this somehow skips the RAM? OpenBSD actually goes a bit further, they have an option to encrypt the swap file.

Re:Pritti, pritti securatay!

[dnaumov]

Forgot to mention: your initial example is rather poor actually. If you are a content provider, serving say... movies. Reading gigantic video files from the RAM in order to steal them is not exactly feasible, at no point is the entire movie loaded into RAM, so you would not only have to process a huge amount of data, but you would also have to wait a lot of time to actually snatch every little loaded piece of the entire file as it gets loaded.

Far from a be-all end-all solution

[NittanyTuring]

AFAIK, this technology would only address a number of physical security threats. Adversaries would be stopped from stealing hard drives, or trying to pick up any bits which leak into the environment (maybe through EM signals). While these problems are important to solve, this technology is far from a be-all end-all solution.

Since the protection only occurs in hardware, one can still exploit the same software-based attack vectors that have been around for ages. Encryption is done even below the OS. If some Trojan horse got kernel-level priveleges and looked at physical RAM, it would see the plaintext and not the ciphertext, All the problems of network security still abound. as data sent out on the network is not protected.

I'm not sure how this could be used for DRM. I guess Secure Blue could be extended to give or take keys over the network, and data can be transmitted as ciphertext and stored as-is into RAM. Can someone explain how this would work? TPMs can be used for DRM, but they work quite differently.

I disagree that the screen is the only place for seeing data unencrypted. Devices will need DMA access to memory, and Secure Blue would have to decrypt the data before sending it down the bus. How is leakage protected in this case?

So in other words

[Anonymous Coward]

As long as all that "Republican" means to you is "They cut taxes and they hate abortion", Clinton wasn't a republican.

I suppose that works, though, because "he cut taxes and he hates abortion" is the only possible definition of "Republican" loose enough that it could reasonably include big-government big-spending nation-building pro-liberalized-immigration George W. Bush.

Re:So in other words

[Lord Kano]

As long as all that "Republican" means to you is "They cut taxes and they hate abortion", Clinton wasn't a republican.

To me, the GOP means that they cut taxes, favor restricting abortion and aren't afraid when "ordinary Americans" own firearms.

LK

Re:So in other words

[DAldredge]

Don't forget that GBW said that he would have signed the AWB renewel had it gotten to his desk.

Re:So in other words

[Lord Kano]

He knew that it never had a chance. It's called politics. He and several Senators were up for reelection. It was never even going to get a full vote before the House or Senate. Gun Control is an issue that few voters vote for, but millions vote against. The Clinton Gun Ban is what lost the House and Senate for the Democrats.

By saying that he'd sign it if it got before his desk, he removed an election issue from the Democrat's arsenal.

LK

Mostly pointless,

[Antony T Curtis]

Unless the user has to switch to CGA 80x25 text mode or if the encrypted data is a bitmap already suitable to blt to the video framebuffer, the user interface of the user's operating system will have access to the unencrypted plaintext.

Just imagine fitting some kind of data capture trojan into the target machine's font renderer. Is this a vector of attack which has been concidered?

Besides, this all does nothing to help against the classical hardware man-in-middle attacks such as a keystroke sniffer device between the keyboard and the computer.

Interesting idea but I think we will all be better served with a new ethernet wire protocol which is simple, transparent and secure. A truely worthy challenge which would benefit the majority of users and would be non-trivial to design.

They like it fine.

[Anonymous Coward]

They don't care how secure the implementation is so long as they have a backdoor.

They don't want to be able to swipe your unencrypted data from your RAM. They want to be able to derive your key (or just look up your key) and decrypt it themselves.

xbox 360 may already use this

[Anonymous Coward]

rumors are that the xbox360 is already using fully encrypted ram. look at its L2 cache miss latencies.

When will we see it?

[Vegeta99]

We'll see it when it's required for the next generation of RIAA/MPAA distribution formats, that's when!

IBM's Long (And Shameful) History With The S.S.

[nick_davison]

Remember that charming comparison:

Reichssicherheitshauptamt, the main division of the Nazi SS translates out as Reich (Homeland) Sicherheit (Security) Huptampt (Department).

And IBM does have a history with those fine people.

The question is whether they remain driven by immediate profit over human rights or whether they're so ashamed of their past that they'll now do anything they can to distance themselves from such organizations.

Re:Career Politics

[BalanceOfJudgement]

Actually, before the Constitution was signed there was no such thing as a "Career Politician." Ever wonder where the "Nomination" process came from?

Originally, someone elected to office did not run for office - it was considered ungentlemanly. Instead, people would nominate who they thought would be a good choice for office, and those people would be the ones who were on the ballot. No campaigning. No campaign finance. No corruption.

Over the 20-30 years following the signing of the Constitution, it became increasingly popular for someone who wanted nomination to run for office; this was made possible by the fact that those eligible to gain positions of power were no longer limited to those of Royal blood - e.g., the rise of the "Common Man."

And the rest, as they say, is history. Campaigning, campaign finance, corruption, and the rise of the career politician who will say anything to get elected and then do nothing but abuse his position.

The days of the honest politician are gone - not because none of them are honest, but because in this country, none of them can afford to be.

brain for sale

[mindbreaks]

brain for sale 1603

Re:Career Politics

[modecx]

Actually, before the Constitution was signed there was no such thing as a "Career Politician.

Oh really? What about Governors and mayors, and the various people who were instituted by The Crown? I think there were career politicains, just not entirely in a democratic context, and maybe not so much on our side of the pond. I think a career of politics was something that the founding fathers were particularly afraid of, along with opressive governments, taxation without representation, and extremist religion influencing the offices, among other things.

1984 all over again...sort of

[grikdog]

Imagine Condoleezza Rice in red hot pants running down the halls of irony, the desperately dilatory demons of delay at her heels, sports bra in the laundry, flinging her Patriot Act at the screen... Who woulda thunk IBM would ever turn out to be the guys in white hats?

Probably AES...

[rtechie]

As AES is the most widely-implemented and most "standard" algorithm, that's probably what they'll use. Another possibility is MARShttp://domino.research.ibm.com/comm/research_p rojects.nsf/pages/security.mars.html IBM's AES candidate, but it was supposedly rejected due to difficulties implementing it in hardware.

Another poster, who doesn't apparently understand the concept, commented that the lack of "CPU overhead" or software implementation will "limit it's usefulness". This is nonsense. Modern (hell, just about ALL) encryption algorithms are designed with hardware implementations in mind, and can perform quite well. Hardware performance was in fact a key issue in the AES competition.

New Macs do have TPMs

[SiliconEntity]

Paolo Attivissimo's blog provides plenty of documented, photo and other evidence that the new Macs do have TPM chips in them. He started out skeptical but soon got plenty of pictures of motherboards from the new Macs. They plainly have Infineon TPM chips in them. It's not clear what if anything they are being used for, but there is no doubt that Intel Macs have TPMs.

Not New

[Non Dufus]

Dallas (now part of Maxim) has been doing this kind of stuff for years with their DS5002/5240/5250 series CPUs (http://www.maxim-ic.com/products/microcontrollers /secure/). Of course these are 8-bit devices that are used primarily for Pin-pad type devices at the Point-of-sale.

Clipper had the LEAF - Law Enforcement Access Fld

[gd23ka]

LEAF = Law Enforcement Access Field and the way I remember it it was a largely publicized deliberate weakening of the
encrypted output so that the coming generation of DHS Megacity Streetjudges like Judge Dredd aka as "Law Enforcement"
could decrypt. Back in the days when Clinton tried to get a handle on Crypto with Clipper the NSA developed algorithm
called Skipjack which was to be used int he chip was still a "National Security" secret and supposed to stay that way.
Needless to say the clipper scheme all thanks to the LEAF was broken in little to no time.

This piece of silicone will have a way to extract user key material and it will even be documented. The simplest thing
to implement something like this is prove to the chip that you have a certain "Law Enforcement Retrieval Authorization Key" to correctly sign the Command-APDU for "LAW ENFORCEMENT RETRIEVE USER KEY MATERIAL" and the chip will encrypt the key material to whatever public "Law Enforcement Retrieval Key" it has been burned with at the factory. The chip will have that kind of functionality. Depend on it.

"...If so, when will we see it if ever?"

[iminplaya]

Yes. Just as soon as the gov't/corps get a key to the back door.

Encrypted chips

[iminplaya]

Good encryption is fine for keeping "real" criminals out of your stuff. They can't have you arrested for refusing to give up your key. The gov't, on the other hand... Keep a secret, go to jail.

Hillary

[Mark_MF-WN]

She does seem to embody liberalism's worst qualities, much in the same way that Dubya embodies conservativism's worst qualities.

Maybe the Conservative party of Canada could open up an American franchise. I bet their brand of rational, secular, balanced conservativism could go far in the US if it got the chance. The conservatives, for their part, would probably dig the chance to work in an environment where the people aren't quite so adamant about having a robust set of social programs, thereby allowing taxes to be slashed down to the marrow. I'm not a fan of conservativism myself, but I can certainly respect it's more logical forms, like what the Reagan administration was trying to push.