Dell to Add Security Chip to PCs

[Dan Kaminsky]

Uh, you *really* have no idea how much the black hat community is 
looking forward to TCPA.  For example, Office is going to have core 
components running inside a protected environment totally immune to 
antivirus.  Since these components are going to be managing 
cryptographic operations, the "well defined API" exposed from within the 
sandbox will have arbitrary content going in, and opaque content coming 
out.  Malware goes in (there's not a executable environment created that 
can't be exploited), sets up shop, has no need to be stealthy due to the 
complete blockage of AV monitors and cleaners, and does what it wants to 
the plaintext and ciphertext (alters content, changes keys) before 
emitting it back out the opaque outbound interface.

So, no FUD, you lose :)

--Dan



Erwann ABALEA wrote:

>On Wed, 2 Feb 2005, Trei, Peter wrote:
>
>  
>
>>Seeing as it comes out of the TCG, this is almost certainly
>>the enabling hardware for Palladium/NGSCB. Its a part of
>>your computer which you may not have full control over.
>>    
>>
>
>Please stop relaying FUD. You have full control over your PC, even if this
>one is equiped with a TCPA chip. See the TCPA chip as a hardware security
>module integrated into your PC. An API exists to use it, and one if the
>functions of this API is 'take ownership', which has the effect of
>erasing it and regenerating new internal keys.
>
>  
>


---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com