Maynard Handley (name99.delete@this.name99.org) on December 12, 2018 10:26 am wrote:
> Anne O. Nymous (not.delete@this.real.address) on December 12, 2018 12:14 am wrote:
> > Maynard Handley (name99.delete@this.name99.org) on December 11, 2018 4:32 pm wrote:
> > > Anon (no.delete@this.email.com) on December 11, 2018 4:21 pm wrote:
> > > > Maynard Handley (name99.delete@this.name99.org) on December 11, 2018 7:20 am wrote:
> > > > >......
> > > > > The crypto has to be appropriate to the problem. This is NOT the equivalent of network crypto.
> > > > > For example, suppose the equivalent of a random key burned into the device is XOR'd with everything
> > > > > going into and out of an MRAM cache (maybe also XOR-in the relevant addresses).
> > > > > Is that good enough? On the off-chance that someone could extract the contents
> > > > > of the MRAM cache (which may or may not be true?) the assumption is always
> > > > > that they CANNOT extract the contents of these sorts of hardware keys.
> > > >
> > > > Such a scheme would be about as secure as writing a key on a yellow postit on your monitor.
> > >
> > > Why do you say that?
> > > This is not a situation where one can watch a constant stream of data and extract statistics.
> > > My threat model is that someone steals a laptop, delids the chip, and has access to the
> > > frozen contents of the MRAM data. Not even the cache tags, just a collection of lines
> > > of data; and not a constant, changing, stream of data as the CPU executes.
> >
> > Mmmh, but could said attacker not try to log-in for a few times to make sure that known
> > code (from the login routine) resides in the cache (and maybe do a memory snapshot before
> > and after and compare). And then the proposed single static key is 'toast', no?
> >
>
> But now you are assuming a totally different threat model! That's my point.
>
> MY assumption was that we have a laptop that's fully protected by current means (so imagine, eg, an
> Apple laptop with login and flash protected by the T2 and full-disk encryption). We're assuming as
> given that you have no control over the laptop; the ONLY thing that's new is the assumption that you
> can delid the SoC and read out the (uncontrolled, but persistent) contents of the MRAM data.

Sorry in my causal reality that does not "compute" if I can delid the SoC I need to have physical access to the device and should be able to attempt something (like the same action the devices owner would perform to unlock the device) that can lead to predictable data ending up in the cache.


> If your starting point is that you have login control of the laptop, then
> what's new about the MRAM? You have login control, what more do you want!

Well the whole thread model of deliding a SoC is premised on having the damn thing in one's hand and the willingness to destroy the device....