[Cryptography] Untrusted Turtles all the way down

Henry Baker hbaker1 at pipeline.com
Thu Apr 9 16:17:29 EDT 2015

I've been working with computers for 54 years, and have watched an amazing & unending series of "virtualization" steps.

Basically, for every "Moore's Law" step, we gain an additional level of emulation; in Turing Machine terminology, each Moore's Law step adds only a small fixed constant amount of tape to store the new instruction set interpreter.

However, each such additional step adds to the threat surface, so from a security perspective things are getting monotonically worse.

How come, therefore, the security "solution" always presented is to pile yet another "trusted" turtle to the stack (e.g., SMM, Trustzone, your favorite ***trust*** word here), in hopes that this will _increase_ security ?

E.g., "UEFI" now looks more like "goofy" in retrospect, because we've added yet another hole to hide in.

Either these new "trusted turtles" are more security theater, or they are a misdirection/cover for some NSA-NSL-inspired new level of nonsense to keep the core wars going for yet another decade.

"Trusted Turtles" or "Untrusted Turtles" all the way down?  Or more succinctly, "Turtles all the way down" v "Turds all the way down" ?

When do we _cut_ the Gordian Knot, instead of trying to untie it?

More information about the cryptography mailing list