The funny thing is that I can remember the same sort of panic in reverse when Lenovo purchased IBMâs PC business over precisely the same fears.
It is interesting to note that a LOT of semiconductor manufacturing is done in Taiwan (technically part of China). The cost of building and running a fab is so outrageous that the vast majority of companies do the design and then pay another company (such as UMC, or TSMC) to manufacture it for you. Since the government is sometimes paranoid about designs being altered to insert back doors, anything custom that needs to be done needs to be done in the US â specifically anything military or handling encryption or classified data (needs to meet ITAR regulations). It is very hard to find a decent ASIC manufacturer in the US.
Of course, you can use off-the-shelf standard products like RAMs FPGAs, and the like, since there is no technical way to insert a back door into such a product that would universally work on any device it was inserted into.
The âyouâ and the âuniversallyâ you use in that last paragraph leave a lot of leeway.
If the âyouâ is the Military Industrial Complex and the âuniversallyâ implies that it would actually work on some devices, then⌠yeah as a psychotically security-oriented power-base; maybe not a good idea. For you.
You can always strip the silicon down layer by layer, image it, and make (reasonably) sure thereâs nothing funny added in there.
I just mean itâs probably not a good idea to use âoff the shelfâ stuff if you are really serious about security. Even if the chances of it being a possible security hole are minimal; itâs still not âno possible security holeâ. If thatâs even a thing.
Then the other option is design it yourself, and in the process probably introduce at least a dozen exploitable bugs.
If you are really serious about security, you have to count with fallibility of individual components (including the biggest hole, the users) and design the whole system to fail gracefully.
Pesky âdivision of labourâ paradigm.
The âyourselfâ can include the whole entity (military, three-letter whateverâŚ). That still includes the problem with bringing in your own bugs, possibly even making it worse.
My yourself is attempting to gracefully agree with your you yourself.
Do you have any idea how much this will cost? Plus, even that might not work well enough. Somebody proved that it was possible to even bias the outputs of a random-number-generator by altering the amount of doping on certain transistors. Yup, that is an âNâ region and that is a "P"region. Of course, if the âNâ is more heavily doped than the âPâ you could bias the RNG to output more ones than zeros, for example.
Not really possible. My point about off-the-shelf stuff is that it is very brittle. Imagine a RAM that will suddenly inject code that causes an exploit in product A. Put this RAM in product B and it would likely just cause the system to fail completely. Even something like an FPGA has to work the way the datasheet says or products start failing. Targeting a hack to work on a specific design means that you first have to know the design before hand, then hand-craft a hack that will target this design without borking the FPGA in other applications. Given how an FPGA is designed, there is little to no room for something like this â it mostly consists of macrocells that are rubber-stamped a few hundred thousand times. With a full-custom design, you could analyze it and insert a hack in place of some of the filler cells.
This topic was automatically closed after 5 days. New replies are no longer allowed.
