Re: Microsoft's Jihad - Palladium

From: Bernd Felsche (bernie@innovative.iinet.net.au)
Date: 06/28/02 

From: Bernd Felsche <bernie@innovative.iinet.net.au>
Date: Fri, 28 Jun 2002 09:41:49 +0800

srt@nospam.unt.edu writes:

>Geoff Lane <zzassgl@twirl.mcc.ac.uk> wrote:

>> In article <afchaf$25g$1@hermes.acs.unt.edu> you wrote:
>>> And if there are cryptographic keys embedded in the hardware,
>>> and they don't tell you what they are, how do you plan on
>>> emulating the hardware?

>> CSS made the same assumption and lasted, what? six months?

>It was a software implementation that was broken. Unless they're
>complete idiots (no comment) they will not allow any software
>implementations of this.

What do you mean by "allow"? You mean as in prohibit?
Using that mechanism is simply naive.

Or do you mean having a piece of hardware whose data transforms
cannot be modelled and hence cannot be implemented in software?

That won't work for anybody but Harry Potter.

>> If the hardware is accessable it is NOT secure. All you have is
>> an example of security by obscurity. There is technology
>> available that can explosively destroy chips when they are
>> tampered with but does anyone think that kind of thing will be
>> acceptable in home computers?

>There are plenty of cost-effective ways to secure hardware (no
>explosives involved!). For instance, before the whole skipjack

Of course there are cost-effective ways of securing data; they're
not completely secure unless you're planning never to use the
hardware - in which case; what's the point of putting the data in
the machine? May as well destroy it using a grinder and acid.

Which brings to light another aspect of security: Security also has
to ensure availability and integrity.

The biggest problem in practice is then lack of backups or failing
to secure backup media. 

-- 
/"\ Bernd Felsche - Innovative Reckoning, Perth, Western Australia
\ /  ASCII ribbon campaign | I'm a .signature virus!
 X   against HTML mail     | Copy me into your ~/.signature
/ \  and postings          | to help me spread!

Relevant Pages

  • Re: Security and EOL issues
    ... OS software resources are designed that reserved ram and disk space among other resources, to reflect what current hardware size is available. ... (There was a security patch a few years ago that could not be applied to NT4 as it required more resources then NT4 could provide. ... Installing air bags requires that the automobile manufacturer design, test, ... Computer Emergency Response Teams, and Digital Investigations. ...
    (Security-Basics)
  • Re: Host-Base Firewall
    ... While hardware security solutions do serve a purpose and do defeat some attacks, they can not solve the human element problem or the evolution problem. ... A while back our research team performed an assessment of several security appliances as a part of an R&D project. ... When we assessed the appliance technology we discovered that the libraries and software that were being used were on average 1-3 years old. ...
    (Security-Basics)
  • Re: 7 Places Where Mac OS X is Still Behind Windows
    ... >> rendering ... no 2D graphics hardware does that. ... >> implement fully accurate Quartz 2D rasterization using shader programs. ... >> Everybody makes security mistakes. ...
    (comp.sys.mac.advocacy)
  • Re: Security via hardware?
    ... http://www.garlic.com/~lynn/2005g.html#51 Security via hardware? ... but this is worrying about the certification of the hardware ... where the validation of a digital signature with a public key implies ...
    (alt.computer.security)
  • Re: The ID Chip You Dont Want in Your Passport
    ... hardware --- The data format was open book dictated by ... My security experience with DOD was minimal as I primarily ... I don't know why anyone would want to, tho. ... I did a private study of the ID field including RFID a couple of years ...
    (soc.retirement)