Slashdot Mirror
IBM Hardwires Encryption Into Chips
zenwarrior writes "Reported by CNET, a new chip technology termed Secure Blue by IBM will keep users' data encrypted and secured at virtually every moment on essentially anything in which the chip can be used. Data is even encrypted in RAM, leaving display for users' viewing as almost the last place it isn't encrypted. This has to be considered decidedly anti-Homeland Defense by the current administration. If so, when will we see it if ever?"
Like the last adminstration would have liked this tech? Face it - neiter party in DC likes anything that takes power away from them.
My guess: In media center PCs in 3... 2... 1...
Interesting report but I would like to see more details, what type of encryption is being used? I think this would be a great thing, however, I can see it being blocked from ever reaching the market due to home security risks, unless there is a backdoor installed which really makes it kinda pointless in the first place.
Regardless it is very interesting that they say this technology can be used on any chip and not just powerPC's, also is the encrypted data tied to the chip or the system, how would this effect SMP systems, or virtual partitions?
GeekServ Unix Consulting Services (http://www.geekserv.com)
This can help you, the end-user secure your data, but is also a necessary component of a DRM hardware solution.
"This has to be considered decidedly anti-Homeland Defense by the current administration."
Unless they designed the backdoor to be inserted....
Cliche, yes. But true. Throwing up more doors is only going to add another layer of UI headache, and it won't do anything to address the issue of say, FBI agents losing their laptops in bars...(http://www.theregister.co.uk/2001/07/18/fb i_loses_hundreds_of_laptops/)
What's to stop the government from seizing both you and your computer, flying you out of the country, and then torturing you until you give up the password?
Besides which, I'm pretty sure the RIAA and the MPAA will get behind this, and they've got Congress in their pocket.
It's not offtopic, dumbass. It's orthogonal.
Who said they would have liked it? The Clinton administration was about as republican as it gets. But it's always the current administration that's under the spotlight. Don't worry -- if and when the Democrats next hold the presidency, everyone will rip them apart for stripping away freedoms as fast as they can. But until then, it's Bush and the cronies who are fucking you over, and so they're the ones that get all the criticism. Criticizing Clinton is, at this point, an exercise in political futility. He can't really do much damage at this point.
These outfits are the same side of the same coin, so there will be no "face off." They're all in cahoots together and you can rely on the fact that the RIAA or any other *AA will fall all over themselves attempting to give the DHS or whomever, any little thing their hearts desire, including whatever keys to whatever algorithm they may be interested in at any given time. It's YOU AND I who are on the outside looking in, here.
Is it fascism yet?
This technology is clearly meant to keep consumers from getting to data they (thought they) bought. If every link in the chain is encrypted, right up to the tamper proof screen and speakers (which will destroy their keys as soon as one attempts to open it, rendering them useless), digital copies of protected media aren't possible anymore.
One small step for IBM, one giant leap for DRM...
However, there's still hope: making tamper proof hardware is very difficult. Making hardware that's not vulnerable to side channel attacks is extremely difficult. And lots of existing cryptographic systems are weak due to misuse of the cryptographic building blocks (think WEP for example). And then there's the weaknesses that are introduced on purpose, to satisfy certain three-letter agencies.
The submitter is using "anti-Homeland Security" as a way of testing the intelligence of Slashdot users. See, this technology is (quite transparently) for digital restrictions enforcement*, which the general population of Slashdot is against. However, the general population of Slashdot is also against the invasions of privacy perpetrated (or attempted to be perpetrated) on US citizens by various agencies with "Homeland Security" agencies**; so the submitter is attempting to skew the conversation (and perhaps eventually general zeitgeist of Slashdot) in the direction of "encryption is good because it's hard to spy on us" and hoping we don't notice that a) it's (probably, haven't RTFA yet) not a publicly available algorithm that real cryptographic experts can examine for weaknesses and b) that we're not in control of what gets encrypted and what doesn't.
Hopefully all of you figured all that out before reading this comment.
--Ender
* Stolen from someone else's sig: "The key to stopping Digital Restrictions Enforcement is to stop calling it DRM." Or maybe it was some other phrase that could have been acronimized to "CRAP".
** A while back, I looked for actual references about the *federal* Department of Homeland Security pulling these stunts. All reports were either hoaxes (Mao's Little Red Book incident), or local agencies with similar names.
Loose things are easy to lose. You're getting your hair cut. They're going there to see their aunt.
Apparently what they're putting in the chips is, at least, encryption/decryption routines. Aside from the obvious questions (what happens when you want to change algorithms?), the important question is whether they're including digital keys as well.
The single factor that makes "trusted computing" evil is that there's a digital key (the "attestation" or "endorsement" key) baked into the TPM which the owner of the machine is prevented from accessing or changing. If all the keys were accessible to the owner, it would be a purely beneficial technology. With the anti-owner feature, it becomes an engine of DRM, censorship, and vendor lock-in on a vast scale, and at a fundamental level absolutely prevents security and privacy for the computer owner.
So the question is which category this IBM tech falls into. And that in turn depends on whether digital keys will be baked into the processor, or whether it's only a set of routines that any software can use under the owner's control.
Seriously, reading that core dump won't be easy...
Not one that relies on draconian hardware chips that prevent you from having control over your computer.
I'm sorry, what? According to wide report, as of the new Intel macs, Apple is in fact using draconian hardware chips that prevent you from having control over your computer, and is reportedly using these specifically to keep you from running OS X on unauthorized hardware. (Though, hilariously enough, that's according to wide report. There is no hard evidence I've seen one way or the other that these chips are or aren't even in the new macs to begin with! All reports of TPM in the Intel macs are based on sort of circumstantial evidence from reports of the developer betas of the Intel macs. Since the actual release of the Intel macs, everyone has gone silent on the subject, and Google doesn't turn up any attempts I can find to take apart the Intel macs and the kernel to see whether TPM is in there. Apparently though the slashdot and tech blogger crowd were angry and opposed to Palladium/TPM for three or five years nonstop since it was announced, they just fell silent once they saw how shiny the new iMacs are.)
You are of course correct that they aren't, of course, using these chips for iTunes or the iPod. Yet. But if the chips are in the machines, they could start using them for such purposes at any time. The iTunes DRM already subtly changes with each iTunes version (the jHymn backup utility still doesn't work with the iTunes 6.0 DRM).
Though all of my computers since I was six years old have been Apples, if it's true that Apple is using TPM in their machines now, it would seem I'm going to be using Linux from now on. I was rather annoyed at the prospect of having to suffer a hardware platform transition (again) to begin with, but I can at least understand the reasoning behind that. But I'm absolutely not willing to pay for a computer if there's this ticking TPM time bomb buried in it that means, if someday the OS vendor changes their mind, a single OS update could sweep through and my computer would no longer be mine.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
My main fear is that the better part of the internet is going to be pushed underground because the gov't wants to read your email and the corps want to charge Google for letting you search for anything.
If these people get their way, there will be no incentive for intelligent people to use an above-ground internet.
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
AFAIK, this technology would only address a number of physical security threats. Adversaries would be stopped from stealing hard drives, or trying to pick up any bits which leak into the environment (maybe through EM signals). While these problems are important to solve, this technology is far from a be-all end-all solution.
Since the protection only occurs in hardware, one can still exploit the same software-based attack vectors that have been around for ages. Encryption is done even below the OS. If some Trojan horse got kernel-level priveleges and looked at physical RAM, it would see the plaintext and not the ciphertext, All the problems of network security still abound. as data sent out on the network is not protected.
I'm not sure how this could be used for DRM. I guess Secure Blue could be extended to give or take keys over the network, and data can be transmitted as ciphertext and stored as-is into RAM. Can someone explain how this would work? TPMs can be used for DRM, but they work quite differently.
I disagree that the screen is the only place for seeing data unencrypted. Devices will need DMA access to memory, and Secure Blue would have to decrypt the data before sending it down the bus. How is leakage protected in this case?