Anon (no.delete@this.email.com) on December 11, 2018 4:21 pm wrote:
> Maynard Handley (name99.delete@this.name99.org) on December 11, 2018 7:20 am wrote:
> >......
> > The crypto has to be appropriate to the problem. This is NOT the equivalent of network crypto.
> > For example, suppose the equivalent of a random key burned into the device is XOR'd with everything
> > going into and out of an MRAM cache (maybe also XOR-in the relevant addresses).
> > Is that good enough? On the off-chance that someone could extract the contents
> > of the MRAM cache (which may or may not be true?) the assumption is always
> > that they CANNOT extract the contents of these sorts of hardware keys.
>
> Such a scheme would be about as secure as writing a key on a yellow postit on your monitor.

Why do you say that?
This is not a situation where one can watch a constant stream of data and extract statistics. My threat model is that someone steals a laptop, delids the chip, and has access to the frozen contents of the MRAM data. Not even the cache tags, just a collection of lines of data; and not a constant, changing, stream of data as the CPU executes.

Is that the threat model you believe you have in mind? If not, well, we are not discussing the same thing.


> Unfortunately the fact is that good encryption is hard, and somewhat computationally involved.
>
> Not to mention the fact that with a static key, both ends
> need that key, as as soon as it leaks, its game over.

Slogans are great. But the relevance of this one is not especially clear to me.

I would be the first to admit that I know very little about crypto. But I know enough to know that not every threat model is the same. AND that this fact is not obvious to many people (hence the split between, eg, the way Apple implemented a very different sort of crypto model for iOS compared to where Android started).