Trusted Computing Group trying to be TCPA follow-on [eetimes]
Bill Stewart
bill.stewart at pobox.com
Wed Apr 9 14:38:36 EDT 2003
New group aims to secure PCs, PDAs, cell phones
By Rick Merritt, EE Times
April 8, 2003 (2:20 p.m. EST)
URL: http://www.eetimes.com/story/OEG20030408S0046
SAN MATEO, Calif. Fifteen companies announced Tuesday [April 8] they have
formed the Trusted Computing Group, an industry initiative to define and
promote a specification for security in PCs, servers, PDAs and cellphones.
The group essentially reboots the efforts of the now-disbanded PC-centric
Trusted Computing Platform Alliance (TCPA), this time including
participation from Nokia and consumer electronics companies such as Sony
and Philips.
The Trusted Computing Group (TCG) expects to release a specification for PC
security before the end of the year. A spec for cell phones, however, could
be as much as two years away.
Founding members of the TCG are carryovers from the earlier 190-member TCPA
effort. They include AMD, Hewlett-Packard, IBM, Intel and Microsoft.
Contributing members include Atmel, Infineon, National Semiconductor,
Nokia, Philips, Phoenix Technologies, Sony, ST Microelectronics, VeriSign
and Wave Systems.
The TCPA defined a trusted platform module (TPM), a basic device with
encryption and secure memory capabilities to oversee PC security. However
the TPM 1.1 chips now shipping from companies such as Atmel, Infineon and
National Semiconductor have not been widely adopted to date and do not
conform to concepts for a secure PC execution mode recently defined by
Microsoft under a program it called Palladium.
The TCG is defining a specification for a 1.2 version TPM and a software
stack that will work with the Palladium architecture Microsoft developed in
collaboration with Intel Corp. and Advanced Micro Devices. Microsoft will
detail this approach publicly for the first time at the Windows Hardware
Engineering Conference in May.
Microsoft's implementation, which it now calls the Next Generation Secure
Computing Base (NGSCB), will require new logic in several PC components
including processors, chip sets, graphics processors and I/O devices.
Indeed, the concept for a secure operating mode is so broad Microsoft will
devote an entire track at WinHEC about 18 hours of content to
describing it.
Microsoft has not said, however, when it will ship software that complies
with NGSCB. Industry watchers expect that code will appear late next year
or early in 2005 in the next major version of Windows, dubbed Longhorn.
The security scheme will work in conjunction with processor functions Intel
Corp. calls Le Grande Technology and has embedded in its next-generation
Pentium processor dubbed Prescott, expected to ship later this year. AMD
will also support the PC security concepts in its processors though it has
not indicated when.
The TPM 1.2 modules will include a new session encryption interface and
secure state counters that prevent replay security attacks, said Stephen
Heil, a technical evangelist for security at Microsoft. The TCG has
separate working groups defining those modules, a security software stack
and particular needs for both servers and PDAs. The TCG is about to launch
a working group to define a specification for secure cellphones, an effort
that could take 18 to 24 months. Nokia is expected to be a key contributor
to that group in addition to other members still being recruited by the TCG.
I would expect to see our membership broaden to include many of the
players required for that effort, said Geoffrey Strongin, a security
specialist at AMD.
Jim Ward, chair of TCG and a security specialist with IBM, said the group
would like to create other specifications for platforms such as set-top
boxes and video game consoles though no active efforts are currently
underway. We are looking to develop a broad specification that can be used
by a broad set of products, he said.
The industry is coming together, said John Hull, director of marketing
for advanced PC products at National Semiconductor.
We are thoroughly convinced that the future of the PC rests on three legs:
networking, security and manageability. You will have to have all three to
play in PCs going forward, he added.
Hull said he expects TPM module makers will update their products to comply
with the new security spec when Prescott processors roll out this fall.
Further in the future, the modules could be integrated into existing PC
components such as SuperI/O parts that provide legacy support for serial,
parallel, keyboard and floppy controllers.
IBM is about the only company in production with systems using the
[standalone] TPM 1.1 devices as far as I know, said Hull.
Ward said IBM has shipped millions of TPM devices in its PC systems. An HP
spokesman said the company has not yet shipped systems with the modules
which typically cost about $5.
We have to increase the rate of adoption. That's why integration with
Super I/O makes a lot of sense. We think this will be a checkbox item going
forward, Hull added.
As a legally incorporated group, the TCG will enforce reasonable and
non-discriminatory licensing of any intellectual property in the spec and
define a mechanism to certify compliance to it. The group is also expected
to take a more pro-active approach than its predecessor to addressing
controversial issues about privacy and digital rights raised by the PC
security effort.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com
More information about the cryptography
mailing list