Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.arch.embedded > #26931 > unrolled thread
| Started by | jhnlmn@gmail.com |
|---|---|
| First post | 2017-06-23 21:34 -0700 |
| Last post | 2017-08-14 09:53 -0700 |
| Articles | 5 on this page of 45 — 12 participants |
Back to article view | Back to comp.arch.embedded
Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-23 21:34 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 09:11 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 15:27 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 16:42 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 19:26 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 21:05 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Bill Davy" <Bill@XchelSys.co.uk> - 2017-06-25 10:37 +0100
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 02:47 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2017-06-25 13:05 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 21:59 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 23:14 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 07:59 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 10:43 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 12:43 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 13:13 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 13:18 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 13:53 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 14:05 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 14:24 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 16:46 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 18:19 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 18:57 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 19:14 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? David Brown <david.brown@hesbynett.no> - 2017-06-26 09:26 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 19:27 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Stef <stef33d@yahooI-N-V-A-L-I-D.com.invalid> - 2017-06-26 08:56 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-26 12:35 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-29 16:09 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-29 10:44 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-29 20:22 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-30 13:44 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? Richard Damon <Richard@Damon-Family.org> - 2017-06-29 23:35 -0400
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-30 13:33 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-30 17:11 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-07-03 12:05 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-03 10:16 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-07-04 13:32 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2017-07-04 13:40 -0400
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-05 14:14 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2017-07-05 19:51 -0400
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-07 17:09 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Chris <xxx.syseng.yyy@gfsys.co.uk> - 2017-07-17 18:52 +0000
Re: Is there a process for secure firmware install/upgrade for device made offshore? Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2017-07-17 21:38 +0200
Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-08-12 18:04 -0700
Re: Is there a process for secure firmware install/upgrade for device made offshore? Paul Rubin <no.email@nospam.invalid> - 2017-08-14 09:53 -0700
Page 3 of 3 — ← Prev page 1 2 [3]
| From | jhnlmn@gmail.com |
|---|---|
| Date | 2017-07-07 17:09 -0700 |
| Message-ID | <804e0601-57af-43db-9c23-c942041e2e3c@googlegroups.com> |
| In reply to | #27003 |
> I only know about it from the Qubes Anti-Evil-Maid defense I read about anti evil maid at https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html and they make it clear that if BIOS is compromised, then all this signature/hash/TPM scheme will not work. This brings us back to square one: how to prevent bootloader from being compromised? To summarize: so far I heard about secure boot loaders only in 2 chip families: Microsemi FPGA and Maxim Cortex MCU with Secure Boot loader.
[toc] | [prev] | [next] | [standalone]
| From | Chris <xxx.syseng.yyy@gfsys.co.uk> |
|---|---|
| Date | 2017-07-17 18:52 +0000 |
| Message-ID | <okj11l$1r6l$1@gioia.aioe.org> |
| In reply to | #27012 |
On 07/08/17 00:09, jhnlmn@gmail.com wrote: >> I only know about it from the Qubes Anti-Evil-Maid defense > > I read about anti evil maid at > https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html > and they make it clear that if BIOS is compromised, then all this signature/hash/TPM scheme will not work. > > This brings us back to square one: how to prevent bootloader from being compromised? > To summarize: so far I heard about secure boot loaders only in 2 chip families: Microsemi FPGA and Maxim Cortex MCU with Secure Boot loader. One queston to ask is: do you really need to ship the firmware to China ?. The reason might be so that the finished item can be tested, but why not ship e minimal firmware, just enough to show that the hardware works ?. Them do the final programming at this side of the pond. If you don't send it, they can't copy it... Chris
[toc] | [prev] | [next] | [standalone]
| From | Hans-Bernhard Bröker <HBBroeker@t-online.de> |
|---|---|
| Date | 2017-07-17 21:38 +0200 |
| Message-ID | <et4i24Fm1u5U1@mid.dfncis.de> |
| In reply to | #27057 |
Am 17.07.2017 um 20:52 schrieb Chris: > One queston to ask is: do you really need to ship the firmware to > China ? That will only get you back to the issue I described 3 weeks ago: installing the secret yourself is not a solution either, because then you will effectively no longer be manufacturing in China. If you have to ship all the stuff back to home base, unwrap it, open it up far enough to get at the internal programming interface to install firmware, then put it all back together again, and re-package for final delivery. The overhead in terms of both delay and money will be considerable. You'll effectively be manufacturing at home. And anyway: how do you know you can actually trust your local employees so much further than your overseas contractors? And of course a criminal at the Chinese end could still side-track to the black market devices with the testing-only software still on them. Good luck explaining to "your" customers why apparently genuine devices do not work _at_all_.
[toc] | [prev] | [next] | [standalone]
| From | jhnlmn@gmail.com |
|---|---|
| Date | 2017-08-12 18:04 -0700 |
| Message-ID | <e8989fb8-d9b8-48ce-9065-565f237172d8@googlegroups.com> |
| In reply to | #27058 |
> Chris > do you really need to ship the firmware to China ? > ... Them do the final programming at this side of the pond. iPhones and most other consumer devices these days are made in China and shipped straight from China to final customers. Most companies do not have even distribution nor manufacturing facilities in US anymore. > Hans-Bernhard Bröker > how do you know you can actually trust your local employees so much further than your overseas contractors? Well, US based employees and contractors can be sued, arrested, etc, Chinese contractors are completely unpunishable. It is just your brain and skills versus theirs. > Good luck explaining to "your" customers why apparently genuine devices do not work _at_all_. I think if we will solve my original problem - how to securely install some secret code and/or key on our devices, then it will be trivial to determine which devices are genuine and which are fake.
[toc] | [prev] | [next] | [standalone]
| From | Paul Rubin <no.email@nospam.invalid> |
|---|---|
| Date | 2017-08-14 09:53 -0700 |
| Message-ID | <87r2we9jlb.fsf@nightsong.com> |
| In reply to | #27167 |
jhnlmn@gmail.com writes: > I think if we will solve my original problem - how to securely install > some secret code and/or key on our devices, then it will be trivial to > determine which devices are genuine and which are fake. I know of a company that got its stuff built at two different Chinese manufacturers, in a way that both manufacturers would have had to collude to get the keys out. I guess that's a start.
[toc] | [prev] | [standalone]
Page 3 of 3 — ← Prev page 1 2 [3]
Back to top | Article view | comp.arch.embedded
csiph-web