[Cryptography] embedding security (was ChaCha)

ianG iang at iang.org
Fri Mar 14 05:31:11 EDT 2014


On 14/03/2014 03:46 am, dan at geer.org wrote:

> If I ran the zoo, I would leave the decision on whether an embedded
> system does or does not have a remote management interface to the
> entity that deploys them subject to a 2-tuple of choices, to wit:
> 
>  * Embedded systems that have a remote management interface must
>  be certified by their maker to be designed such that when said
>  remote management interface is operated according to spec, the
>  maker shall be found negligent, per se, were the management interface
>  found to have been be jimmied by an attacker.
> 
>  * Embedded systems that have no remote management interface shall
>  be so designed as to die without fail no later than some fixed
>  time, which time is stated in advance.
> 
> This precludes, and I mean by statute, the possibility of an embedded
> system being at once blamelessly immortal, unupdatable, and vulnerable.


True, but it might embed a blameless immortal unupdatable vulnerability
into the host manufacturer.

Assume the cost of the embedded device is some number X.  Installing it
into a largish installation (with many devices) is probably some factor
fX where f is o(10).  Which leads to some interesting economics.

As the owner of device 2 is now likely responsible for replacement in
some foreseeable time, he's going to have to plan on that (f+1)X cost
into the future on that regular basis.  So let's say this is a
slam-dunk, and he switches over to device 1.

Yet, device 1 also has finicky requirements.  Probably, such a system
can only be operated with a remote management console of some form.  Add
in some form of approved network.  And now we're looking not at a device
but at a system.

Which as the manufacturer is now liable for, she's also keen to certify
(maybe) or operate directly.  The more complexity, and the more
liability, the more the tendency to vertical integration.  Factor in
desires to increase margins, desires to acquire additional protection
from a wall-of-standards and fat pentagon contracts and guild
certifications, and the tendency will probably emerge without much
kicking from outside.

So we'll find that there is now a tax t over the additional raw costs
due to oligopoly controls.  In most countries there will be one major
dominant player, the rest will be shut out of the big contracts.  In the
US there will be 2-4 as always.

The end result then will be a facade of control but a patchwork of
weakness, and most of the control will be directed at preserving the
structure.  Typically I'd expect that we would find that the secure
remote consoles themselves become the fast way into pervert the entire
network, and the manufacturer was breached way back when by all the
agencies.

This notion of a secure embedded device may be worth something, but are
the consequences of an insecure embedded industry worth something as well?



iang


More information about the cryptography mailing list