Are there any generally available microcontrollers with this block inside?
“Open source” has a very different meaning when it comes to silicon.
OpenTitan Shipping in Production
11–20 of 39 posts
Re: OpenTitan Shipping in Production
#12Ah, I see. It's just another fucking tpm, which let's venders approve or deny execution of signed binaries. So more infrastructure to attack general computing.
Re: OpenTitan Shipping in Production
#13Are there any generally available microcontrollers with this block inside? “Open source” has a very different meaning when it comes to silicon.
OpenTitan _is_ a microcontroller, just one with a _lot_ of security hardware (and security proofs).
It's intended to be integrated into a larger SoC and used for things like secure boot, though you could certainly fab it with its own RAM and GPIO and use it standalone.
Re: OpenTitan Shipping in Production
#14I'm not seeking to criticise this product, I think this is a great development. But, for almost all people this is shifting from one kind of "trust me bro" to .. another. We're not going to be able to formally prove the chip conforms to some (verilog?) model, has no backdoors, side channels, you-name-it. We're in the same place we were, with the same questions. Why do we trust this and the downstream developments? Be…
> not going to be able to formally prove the chip conforms to some (verilog?) model
Sure you can. Get together as a group. Purchase a large lot of chips. Select several at random. Shave them down layer by layer, imaging them with an SEM. You now have an extremely high level of confidence that all the chips in the lot are good.
Physical security aside, I share your concerns about the abusive corporate behavior that widespread deployment of such hardware might enable.
> Knowing you are talking to the chipset which signed the certificate request you asserted to before shipping is useful.
Can't an fTPM with a sealed secret already provide that assurance? Or at least the assurance that you actually care about - that the software you believe to be running actually is. At least assuming we stop getting somewhat regular exploits against the major CPU vendors.
Re: OpenTitan Shipping in Production
#15This is really great. OpenTitan has some useful IP components that can definitely be reused, and it's really cool that this is open. Nice one Google. I have to minority nitpick though: > both individual IP blocks and the top-level Earl Grey design have functional and code coverage above 90%—to the highest industry standards—with 40k+ tests running nightly This is definitely not "to the highest industry standards". I'…
I think they're saying the coverage they have is to the highest industry standards, not that 90% is a high standard.
Re: OpenTitan Shipping in Production
#16[deleted]
Re: OpenTitan Shipping in Production
#17Whos keys does this thing trust by default?
Re: OpenTitan Shipping in Production
#18> will support ... secure boot and attestation.
Not something I would want to touch.
Re: OpenTitan Shipping in Production
#19This is really great. OpenTitan has some useful IP components that can definitely be reused, and it's really cool that this is open. Nice one Google. I have to minority nitpick though: > both individual IP blocks and the top-level Earl Grey design have functional and code coverage above 90%—to the highest industry standards—with 40k+ tests running nightly This is definitely not "to the highest industry standards". I'…
You can see the latest nightly results here: https://opentitan.org/dashboard/index.html note there are some 100% figures.
Having spent several years working on OT I can tell you that most of the gaps are things that should be waived anyway. Getting waiver files reliably integrated into that flow has been problematic as those files are fragile, alter the RTL and they typically break as they refer to things by line number or expect a particular expression to be identical to when you did a waiver for it.
This has all been examined and the holes have been deemed unconcerning, yes ideally there'd be full waivers documenting this but as with any real life engineering project you can't do everything perfectly! There is internal documentation explaining the rationale for why the holes aren't a problem but it's not public.
Re: OpenTitan Shipping in Production
#20This is really great. OpenTitan has some useful IP components that can definitely be reused, and it's really cool that this is open. Nice one Google. I have to minority nitpick though: > both individual IP blocks and the top-level Earl Grey design have functional and code coverage above 90%—to the highest industry standards—with 40k+ tests running nightly This is definitely not "to the highest industry standards". I'…
You can see the latest nightly results here: https://opentitan.org/dashboard/index.html note there are some 100% figures. Having spent several years working on OT I can tell you that most of the gaps are things that should be waived anyway. Getting waiver files reliably integrated into that flow has been problematic as those files are fragile, alter the RTL and they typically break as they refer to things by line num…
> Getting waiver files reliably integrated into that flow has been problematic as those files are fragile, alter the RTL and they typically break as they refer to things by line number or expect a particular expression to be identical to when you did a waiver for it.
Yeah last time I did this we used regexes but I really don't like that solution. I think the waiver should go in the RTL itself. I don't know why nobody does that - it's standard practice in software. SV even supports attributes exactly for this sort of thing. The tools don't support it but you could make a tool to parse the files and convert it to TCL. I've done something like that using the Rust sv-parser crate before. Tedious but not impossible.
Also we found the formal waiver analysis tools to be very effective for waiving unreachable code, in case you aren't using those.
Congrats on the silicon anyway!