Yubico: Secure Hardware vs. Open Source

Post by uola » Tue, May 17, 2016, 5:22 AM UTC

zobzu wrote: post #46

davideous wrote: post #11

In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system." Youbico isn't saying that the security of the device is increased by keepin…

This isnt about security. Its about its was open source before and user modifiable and it no longer is. You can force wipe on flash for example. They clearly changed stance to ensure users cannot play with the hardware and competitors cannot copy the code. Which is fine. But its always weird when the argument of security is used instead of being genuine. You can copy the freaking key by removing the plastic of the yu…

Post by schoen » Tue, May 17, 2016, 5:32 AM UTC

na85 wrote: post #34

colemickens wrote: post #32

Earlier quoted context omitted.

None of which precludes the implementation from being open source. In fact, it just means that even if the software were open source, it would be near-meaningless since I can't verify the code running on the device and can't reflash it myself. "Youbico isn't saying that the security of the device is increased by keeping the source code secret." Yeah, they're not really saying anything other than trying to provide an…

There's a market disruption opportunity here. Carpe consumer base.

Post by colemickens » Tue, May 17, 2016, 5:37 AM UTC

davideous wrote: post #35

colemickens wrote: post #32

Earlier quoted context omitted.

None of which precludes the implementation from being open source. In fact, it just means that even if the software were open source, it would be near-meaningless since I can't verify the code running on the device and can't reflash it myself. "Youbico isn't saying that the security of the device is increased by keeping the source code secret." Yeah, they're not really saying anything other than trying to provide an…

I think if they released the source, but you weren't able to reflash the device (which is a design trade-off they chose to close some attack vendors), people would be up-in-arms and saying "it's not true open source because I can't re-flash or verify the device."

Post by sgift » Tue, May 17, 2016, 5:40 AM UTC

dublinben wrote: post #44

rrego wrote: post #8

Earlier quoted context omitted.

That's a very disingenuous summary. It seems impossible to make the device open due to the NDAs. Can you explain how they would get around these? With regards to the applet manager, that seems to be an issue with customer friction less so than being too hard. While "crypto nerds" would be fine, business applications could be affected.

Not using hardware components that would require NDAs would be the obvious alternative.

  So — why not combine the best of two worlds then, i.e.
  using secure hardware in an open-source design? There 
  are a few problems with that:

  - There is an inverse relationship between making a 
  chip open and achieving security certifications, such as 
  Common Criteria. In order to achieve these higher levels
   of certifications, certain requirements are put on the 
  final products and their use and available modes.

  - There are, in practice, only two major players 
  providing secure silicon and none of their 
  products/platforms are available on the open market for 
  developers except in very large volumes.

  - Even for large volume orders, there is a highly 
  bureaucratic process to even get started with these 
  suppliers: procedures, non-disclosure agreements, secure 
  access to datasheets, export control, licensing terms, 
  IP, etc.

  - Since there is no debug port, embedded development
  becomes a matter of having an expensive emulator and 
  special developer licenses, again available only under 
  NDA.

  - Although this does not prevent the source code from 
  being published, without the datasheets, security 
  guidelines, and a platform for performing tests, the 
  outcome is questionable, with little practical value.

Post by rcthompson » Tue, May 17, 2016, 5:48 AM UTC