Zentool – AMD Zen Microcode Manipulation Utility
1–10 of 69 posts
Re: Zentool – AMD Zen Microcode Manipulation Utility
#2> You can use the `resign` command to compensate for the changes you made:
How does that work? Did someone figure out AMD's private keys?
Re: Zentool – AMD Zen Microcode Manipulation Utility
#3The blog post that explains the exploit and how this whole thing works is at https://bughunters.google.com/blog/5424842357473280/zen-and-...
Re: Zentool – AMD Zen Microcode Manipulation Utility
#4> You can use the `resign` command to compensate for the changes you made: How does that work? Did someone figure out AMD's private keys?
The intro document mentions
> Here's the thing - the big vendors encrypt and sign their updates so that you cannot run your own microcode. A big discovery recently means that the authentication scheme is a lot weaker than intended, and you can now effectively "jailbreak" your CPU!
But there's no further details. I'd love to know about the specifics too!
Re: Zentool – AMD Zen Microcode Manipulation Utility
#5> You can use the `resign` command to compensate for the changes you made: How does that work? Did someone figure out AMD's private keys?
The intro document mentions > Here's the thing - the big vendors encrypt and sign their updates so that you cannot run your own microcode. A big discovery recently means that the authentication scheme is a lot weaker than intended, and you can now effectively "jailbreak" your CPU! But there's no further details. I'd love to know about the specifics too!
They accidentally used the example key from AES-CMAC RFC, the full details are in the accompanying blog post: https://bughunters.google.com/blog/5424842357473280/zen-and-...
Re: Zentool – AMD Zen Microcode Manipulation Utility
#6> You can use the `resign` command to compensate for the changes you made: How does that work? Did someone figure out AMD's private keys?
This work is related to recently found signing weakness and supposedly fake key with resign works with unpatched CPUs.
Re: Zentool – AMD Zen Microcode Manipulation Utility
#7Both AMD and Google note, that Zen[1-4] are affected, but what changed about Zen5? According to the timeline, it released before Google notified AMD [1].
Is it using different keys, but same scheme (and could possibly be broken via side-channels as noted in the article)? Or perhaps AMD notices something and changed up the microcode? Some clarification on that part would be nice.
[1] https://github.com/google/security-research/security/advisor...
Re: Zentool – AMD Zen Microcode Manipulation Utility
#8Was the microcode signing scheme documented by AMD, or did the researchers have to reverse engineer it somehow? I couldn't see a mention in the blog post.
Re: Zentool – AMD Zen Microcode Manipulation Utility
#9Was the microcode signing scheme documented by AMD, or did the researchers have to reverse engineer it somehow? I couldn't see a mention in the blog post.
From the blog post:
> We plan to provide additional details in the upcoming months on how we reverse engineered the microcode update process, which led to us identifying the validation algorithms
Re: Zentool – AMD Zen Microcode Manipulation Utility
#10Earlier quoted context omitted.
The intro document mentions > Here's the thing - the big vendors encrypt and sign their updates so that you cannot run your own microcode. A big discovery recently means that the authentication scheme is a lot weaker than intended, and you can now effectively "jailbreak" your CPU! But there's no further details. I'd love to know about the specifics too!
They accidentally used the example key from AES-CMAC RFC, the full details are in the accompanying blog post: https://bughunters.google.com/blog/5424842357473280/zen-and-...
Taking "never roll your own" too far.