I read until Google.
OpenTitan Shipping in Production
21–30 of 39 posts
Re: OpenTitan Shipping in Production
#22I'm not seeking to criticise this product, I think this is a great development. But, for almost all people this is shifting from one kind of "trust me bro" to .. another. We're not going to be able to formally prove the chip conforms to some (verilog?) model, has no backdoors, side channels, you-name-it. We're in the same place we were, with the same questions. Why do we trust this and the downstream developments? Be…
These things should be manufactured to be IRIS-compatible. IRIS is the "Infra-Red, In Situ" technique which lets you image the silicon of a chip through the packaging to verify that you don't have a counterfeit.
https://arxiv.org/pdf/2303.07406
Like, for example, the Boachip-1x MCU.
https://www.cnx-software.com/2026/03/04/dabao-board-features...
Re: OpenTitan Shipping in Production
#23Ah, I see. It's just another fucking tpm, which let's venders approve or deny execution of signed binaries. So more infrastructure to attack general computing.
No, TPMs and HSMs are fundamentally nothing more than secure hardware dedicated to storing private keys in a way that makes accessing the plaintext incredibly hard. All of modern computer security is based on them.
Re: OpenTitan Shipping in Production
#24Earlier quoted context omitted.
You can see the latest nightly results here: https://opentitan.org/dashboard/index.html note there are some 100% figures. Having spent several years working on OT I can tell you that most of the gaps are things that should be waived anyway. Getting waiver files reliably integrated into that flow has been problematic as those files are fragile, alter the RTL and they typically break as they refer to things by line num…
> Getting waiver files reliably integrated into that flow has been problematic as those files are fragile, alter the RTL and they typically break as they refer to things by line number or expect a particular expression to be identical to when you did a waiver for it. Yeah last time I did this we used regexes but I really don't like that solution. I think the waiver should go in the RTL itself. I don't know why nobody…
> Also we found the formal waiver analysis tools to be very effective for waiving unreachable code, in case you aren't using those.
Yes we had used them just never got it slickly integrated into the verification dashboard. We had used this kind of analysis for internal sign off. You could generate the waivers manually and check them in but that suffers from the problem discussed above. Plus as OpenTitan was a cross company project you run into EDA licensing issues where not everyone has access to the same set of tools and a UNR flow could be running fine on one partner's infrastructure but isn't workable everywhere for multitude of reasons.
The ideal would be the nightly regression would do the UNR flow to generate the waivers and apply them when generating coverage but as ever there's only so much engineering time to go around and always other priorities.
Re: OpenTitan Shipping in Production
#25I'm not seeking to criticise this product, I think this is a great development. But, for almost all people this is shifting from one kind of "trust me bro" to .. another. We're not going to be able to formally prove the chip conforms to some (verilog?) model, has no backdoors, side channels, you-name-it. We're in the same place we were, with the same questions. Why do we trust this and the downstream developments? Be…
I'm more worried by the motivation for the whole secure chain. We will not own our devices and the encryption keys will be stored in vault of like MS or Google, free to peruse by the government
The entire push seems to be motivated by actors that want to deny users access to their own devices in thinly veiled promises of "security".
It's basically asking someone to give their company your house keys on nothing more than "trust me bro".
And it's completely opposite of how it should be, it should be my device that I then can give the vendor app limited sandbox that I can access fully, not the other way around.
Re: OpenTitan Shipping in Production
#26Whos keys does this thing trust by default?
I'd imagine whatever was loaded at factory.
So, google, samsung, take your pick. User ones ? Nah, we cant trust user
Re: OpenTitan Shipping in Production
#27Ah, I see. It's just another fucking tpm, which let's venders approve or deny execution of signed binaries. So more infrastructure to attack general computing.
No, TPMs and HSMs are fundamentally nothing more than secure hardware dedicated to storing private keys in a way that makes accessing the plaintext incredibly hard. All of modern computer security is based on them.
... and usually deployed in a user-hostile manner.
Re: OpenTitan Shipping in Production
#28Earlier quoted context omitted.
No, TPMs and HSMs are fundamentally nothing more than secure hardware dedicated to storing private keys in a way that makes accessing the plaintext incredibly hard. All of modern computer security is based on them.
... and usually deployed in a user-hostile manner.
Any evidence of this? Computer security was a complete disaster before hardware roots of trust became standard.
Re: OpenTitan Shipping in Production
#29Re: OpenTitan Shipping in Production
#30Earlier quoted context omitted.
Any evidence of this? Computer security was a complete disaster before hardware roots of trust became standard.
Both things can be true.
The knee-jerk hysterical reaction to any talk of hardware roots of trust on Hacker News is getting tiresome and I expect better given the reputation of the site. It actually reminds me of old slashdot.