Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

anandtech.com

Post reply on HN
Print view View original

41–50 of 172 posts

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#41

Post by carlsborg »

darzu wrote: post #17

I worked extensively with Pluton when I was employed on Azure Sphere (an IoT platform marketed as highly secure and composed of a linux-based OS, ARM SoC, and cloud service). I might be able to answer questions about this. Here’s a blog by the engineer lead on Azure Sphere that discusses Pluton: https://azure.microsoft.com/en-us/blog/anatomy-of-a-secured-... Disclaimer: I still work at MSFT but in a different org.

1. Is this specific to Azure Sphere CPUs? Or are general purpose intel CPUs going to have this capability.

2. If the latter, "Every piece of software on an Azure Sphere device must be signed by Microsoft." what does the OS interface look like?

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#42

Post by ffhhj »

azalemeth wrote: post #9

A previous HN link is here -- https://news.ycombinator.com/item?id=25131431 -- which links to MS's original press release -- https://www.microsoft.com/security/blog/2020/11/17/meet-the-... . That article explicitly states that it was designed originally for the xbox. I worry that going to be a very anti-consumer, anti-free-speech, DRM heavy chip that MS want to popularise as an alternative to the (still hated in some…

Seems like a good way to perform surveillance, governments and agencies will be the clients. "You are our product" - Microsoft

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#43

Post by qayxc »

1vuio0pswjnm7 wrote: post #27
qayxc wrote: post #15

Earlier quoted context omitted.

> will this allow hardware vendors additional means to prevent me from installing Linux? No. Pluton serves as an on-chip secure enclave for encryption keys and the like. This is unrelated to installing operating systems.

Will the final purchaser of the computer chip, i.e., the consumer, have r/w access to the contents of the enclave? EDIT: s/access/r\/w & to the contents of/

I don't know. I can't even speculate without knowing what you mean by "access to the enclave".

If you mean access as in being able to arbitrarily read and write keys or data to/from it, then no, you won't be able to access it that way. After all that's the whole point - even physical access to the hardware won't enable you to extract information (keys, etc.) from it.

This means any data or firmware stored on the chip by Microsoft or any OEM (e.g. firmware encryption keys or device signatures) won't be accessible to consumers.

TPMs define interfaces, though that allow programs to access its capabilities, so there are ways to interact with the hardware (and those are documented as well so you can write applications or operating systems that support it).

To get an idea what the interface looks like, you can check out the documentation of the Windows API: https://docs.microsoft.com/en-us/windows/win32/secprov/win32...

There's also a list of some TPM commands available on the same site: https://docs.microsoft.com/en-us/windows/win32/secprov/addbl...

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#44

Post by phkahler »

dpoochieni wrote: post #31
azalemeth wrote: post #9

A previous HN link is here -- https://news.ycombinator.com/item?id=25131431 -- which links to MS's original press release -- https://www.microsoft.com/security/blog/2020/11/17/meet-the-... . That article explicitly states that it was designed originally for the xbox. I worry that going to be a very anti-consumer, anti-free-speech, DRM heavy chip that MS want to popularise as an alternative to the (still hated in some…

Imagine it being capable of enforcing something like which executables you are able to load... Quite in the vein of Apple sending the executables hash to some random server

Imagine it can only run MS Linux or Windows.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#46

Post by darzu »

carlsborg wrote: post #41
darzu wrote: post #17

I worked extensively with Pluton when I was employed on Azure Sphere (an IoT platform marketed as highly secure and composed of a linux-based OS, ARM SoC, and cloud service). I might be able to answer questions about this. Here’s a blog by the engineer lead on Azure Sphere that discusses Pluton: https://azure.microsoft.com/en-us/blog/anatomy-of-a-secured-... Disclaimer: I still work at MSFT but in a different org.

1. Is this specific to Azure Sphere CPUs? Or are general purpose intel CPUs going to have this capability. 2. If the latter, "Every piece of software on an Azure Sphere device must be signed by Microsoft." what does the OS interface look like?

1. I assume this is not just for Azure Sphere since the goal when I was there was to be a low-cost, low-energy platform. Also the announcements make it sound like a general offering.

2. Pluton can check the signature of software before booting it on the A7 core.

Hope that helps!

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#47

Post by gruez »

warkdarrior wrote: post #16
gruez wrote: post #5

Isn't this basically fTPM (basically software TPM implemented in the trusted execution environment of the CPU) that both AMD and Intel already offer?

It'll be built into the CPU, instead of having a separate chip, and seems to have secret-management functionality for user-specified keys, biometrics, etc.

>It'll be built into the CPU, instead of having a separate chip

so are the trusted execution environments used by fTPMs?

>seems to have secret-management functionality for user-specified keys

AFAIK TPMs already have that functionality. random search: https://github.com/tpm2-software/tpm2-tools/blob/master/man/...

>biometrics, etc.

AFAIK some fingerprint readers already use trusted execution environments to handle authentication, so from a feature point of view there isn't really anything new here.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#48

Post by core-questions »

gotstad wrote: post #24
azalemeth wrote: post #9

A previous HN link is here -- https://news.ycombinator.com/item?id=25131431 -- which links to MS's original press release -- https://www.microsoft.com/security/blog/2020/11/17/meet-the-... . That article explicitly states that it was designed originally for the xbox. I worry that going to be a very anti-consumer, anti-free-speech, DRM heavy chip that MS want to popularise as an alternative to the (still hated in some…

How do you see it being anti-free-speech?

Virtually every technology that can be used to create a walled garden with moderation can be bent to limit people's ability to speak freely.

How long until someone has a device which can go to Netflix, social networking, etc. but doesn't have a web browser on it that can load arbitrary pages, and it's impossible to jailbreak?

Since we have no freedom of speech within FAANG properties, that would be a considerable restriction of speech...

I do always find it wryly amusing when people who identify as being on the left see that the right are the only people who need defense using free speech laws, and then happily allow private industry to restrict speech since it doesn't impact them. The shoe could just as easily be on the other foot, and may well again be one day - principles matter.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#49

Post by qayxc »

azalemeth wrote: post #9

A previous HN link is here -- https://news.ycombinator.com/item?id=25131431 -- which links to MS's original press release -- https://www.microsoft.com/security/blog/2020/11/17/meet-the-... . That article explicitly states that it was designed originally for the xbox. I worry that going to be a very anti-consumer, anti-free-speech, DRM heavy chip that MS want to popularise as an alternative to the (still hated in some…

> Why else would they design it for the xbox, of all things?

If you really want to know the answer, here's the lead engineer explaining it en detail: https://www.youtube.com/watch?v=quLa6kzzra0

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#50

Post by qayxc »

dpoochieni wrote: post #31
azalemeth wrote: post #9

A previous HN link is here -- https://news.ycombinator.com/item?id=25131431 -- which links to MS's original press release -- https://www.microsoft.com/security/blog/2020/11/17/meet-the-... . That article explicitly states that it was designed originally for the xbox. I worry that going to be a very anti-consumer, anti-free-speech, DRM heavy chip that MS want to popularise as an alternative to the (still hated in some…

Imagine it being capable of enforcing something like which executables you are able to load... Quite in the vein of Apple sending the executables hash to some random server

That's not how that works. At all.
Post reply on HN