hackertube.io

36C3 - Open Source is Insufficient to Solve Trust Problems in Hardware

media.ccc.de · talk · Watch on YouTube

Security & hackingSemiconductors & chip manufacturingHacker culture & free software

What it is

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

Why Hacker News recommends it

HN commenters point to it whenever the question is how far hardware can be trusted, including FPGAs, supply chain attacks and firmware TPMs.

  • 2 people recommended it
  • 3 different months
  • 2 strong recommendations
  • first 2020, last 2023

What HN commenters said

  1. “Here's an excellent talk that addresses your question”

    Excellent talk on trust problems in hardware

    Confiks, 2020-05 · Strong recommendation · in “OpenTitan RTL Synthesis with Yosys”

  2. “did an excellent talk on the subject”

    Bunnie's talk on FPGAs and physical supply chain attacks

    kfreds, 2023-05 · Recommendation · in “AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defeating Disk Encryption”

Excerpts from Hacker News comments, linked to the originals. Summaries and labels were written by a language model from those comments.

Topics: hardware security, supply chain, fpga, open hardware, betrusted, toctou

Also recommended by the same people