Can someone explain what this is or what it is competing against?
OpenTitan: An open-source silicon root of trust from lowRISC
11–19 of 19 posts
Re: OpenTitan: An open-source silicon root of trust from lowRISC
#12What application does a hardware-backed root of trust have for more consumer/non-server products like laptops/phones? Dos this differ substantially from a TPM? Could it be used to verify integrity of a system from power-on to finishing booting say a Linux distro?
Apparently Google phones and some Chromebooks have a Titan-C chip [1], although it's not clear how it's more secure than the Intel secure boot architecture. [1] Google managed to build a chip with an un-Google-able name
Re: OpenTitan: An open-source silicon root of trust from lowRISC
#13Can someone explain what this is or what it is competing against?
It's way for big software and/or hardware companies to block you from running your own Linux distribution of choice.
(I'm exaggerating, but only very slightly, by a nanometer.)
Re: OpenTitan: An open-source silicon root of trust from lowRISC
#14Earlier quoted context omitted.
The question would be: how expensive is it to pay off the NDA-schenannigans for a mostly-obsolete node at a small, practically defunct fab? It should be a competitive advantage at that point.
When I last quoted, about $200k for the Hong Kong guys and 4-5 million for the Minnesota/Florida folks. Hong Kong was a much bigger process node.
4-5 million seems worth to try a kickstarter or so for.
If it succeeds, it'll open all this needed info. Kickstarter pledges convert at some ratio into credits that can be used to pay the fab.
Re: OpenTitan: An open-source silicon root of trust from lowRISC
#15Can someone explain what this is or what it is competing against?
It's way for big software and/or hardware companies to block you from running your own Linux distribution of choice. (I'm exaggerating, but only very slightly, by a nanometer.)
OpenTitan seems to be mainly oriented towards servers, though the announcement post [1] does mention that it could also be used for client devices.
[1] https://security.googleblog.com/2019/11/opentitan-open-sourc...
Re: OpenTitan: An open-source silicon root of trust from lowRISC
#16What application does a hardware-backed root of trust have for more consumer/non-server products like laptops/phones? Dos this differ substantially from a TPM? Could it be used to verify integrity of a system from power-on to finishing booting say a Linux distro?
Apparently Google phones and some Chromebooks have a Titan-C chip [1], although it's not clear how it's more secure than the Intel secure boot architecture. [1] Google managed to build a chip with an un-Google-able name
The chip in Chromebooks is called cr50 or h1. It has open source firmware (https://github.com/coreboot/chrome-ec/tree/master/board/cr50) and a few public mentions, e.g. https://2018.osfc.io/talks/google-secure-microcontroller-and...
Re: OpenTitan: An open-source silicon root of trust from lowRISC
#17Can someone explain what this is or what it is competing against?
> Silicon RoT can help ensure that the hardware infrastructure and the software that runs on it remain in their intended, trustworthy state by verifying that the critical system components boot securely using authorized and verifiable code.
The idea is that the firmware can't be modified without causing errors to propagate, errors that may not be able to be bypassed.
It can do some good things like protecting encryption keys, but mostly it allows someone to verify their server is exactly as they intended. Preventing a few high impact hijacking techniques that are incredibly difficult to pull off.
However, similar things have crept into consumer-grade hardware, where it's used to prevent someone from using a device for how _the owner_ intends, which is not so good.
---
This thing isn't really competing with many. It's an open-sourcing of Google's Titan [0], in an area which is fairly new. It's an attempt to own the niche.
[0] https://security.googleblog.com/2019/11/opentitan-open-sourc...
Re: OpenTitan: An open-source silicon root of trust from lowRISC
#18Can someone explain what this is or what it is competing against?
It's way for big software and/or hardware companies to block you from running your own Linux distribution of choice. (I'm exaggerating, but only very slightly, by a nanometer.)
Exactly. The bottom line is hardware that will only run trusted software. The problem then becomes determining who gets to sign software.
Better would be to just have a physical switch to disable firmware writes.
Re: OpenTitan: An open-source silicon root of trust from lowRISC
#19I see no mention of the ability to use it in one's own designs, which seems like an oversight to me ("source available" vs "free software/hardware"). However, the repository's license seems to be Apache 2.0.