Secure Hardware and Open Source: An Alternative to Java Card
1–10 of 22 posts
Re: Secure Hardware and Open Source: An Alternative to Java Card
#2This is relevant for things like OpenPGP Card (http://g10code.com/p-card.html) etc. Running free software on practically non-researchable proprietary platform is worrying.
Re: Secure Hardware and Open Source: An Alternative to Java Card
#3It's gonna be hard if you really want security. Card developers put a lot of effort into securing operations against sidechannel pertuberation, sidechannel and many more attacks, that opensource developers will hardly be able to handle on theeir own.
Re: Secure Hardware and Open Source: An Alternative to Java Card
#4Here is a fully open secure hardware device:
(Please don't submit this link to HN. I want to stay somewhat stealthy until I've had a chance to write an introductory article.)
At the moment it's only a prototype. I have done a very small production run, so if you want one to experiment with, contact me. I'm planning on doing a kickstarter to fund a real production run.
Re: Secure Hardware and Open Source: An Alternative to Java Card
#5So what measures does this "secure" C alternative offer against memory corruption to be positioned as better option than Java Card?!
Re: Secure Hardware and Open Source: An Alternative to Java Card
#6Was there a justification why the Ledger Blue still has a proprietary HAL?
Re: Secure Hardware and Open Source: An Alternative to Java Card
#7[deleted]
Re: Secure Hardware and Open Source: An Alternative to Java Card
#8Here is a fully open secure hardware device: https://sc4.us/hsm/ (Please don't submit this link to HN. I want to stay somewhat stealthy until I've had a chance to write an introductory article.) At the moment it's only a prototype. I have done a very small production run, so if you want one to experiment with, contact me. I'm planning on doing a kickstarter to fund a real production run.
One thing that seems to be missing from your project is the actual "HSM-ness". Things like side channels and so probably are not relevant to the target market, but some kind of assurance that device's firmware was not tampered with is probably required.
Re: Secure Hardware and Open Source: An Alternative to Java Card
#9Was there a justification why the Ledger Blue still has a proprietary HAL?
yes, some parts of the chip are still available only under NDA (typically I/Os, cryptographic accelerators, tamper detection)
Re: Secure Hardware and Open Source: An Alternative to Java Card
#10So what measures does this "secure" C alternative offer against memory corruption to be positioned as better option than Java Card?!
It's based on public ARM specifications (MPU + service calls) so the attack surface is way smaller compared to a virtual machine and the performance is of course way better. Applications can still corrupt their own memory space temporarily (not rewrite their code) but can't touch other applications or the Operating System.