[117727] in Cypherpunks
Re: hw vs sw, intel rng mystery
daemon@ATHENA.MIT.EDU (Tim May)
Thu Sep 9 14:12:52 1999
Message-Id: <v03130302b3fd9f181ea4@[207.111.241.66]>
In-Reply-To: <199909091635.SAA02608@mail.replay.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 9 Sep 1999 10:50:18 -0700
To: cypherpunks@cyberpass.net
From: Tim May <tcmay@got.net>
Reply-To: Tim May <tcmay@got.net>
At 9:35 AM -0700 1999-09-09, Anonymous wrote:
>This is the "what are they hiding" part... the kT
>dependence of their noise source? Did they think
>it wasn't worth the insignificant number of gates
>it would take to add this? That reading raw bits would hog
>the cpu too much for it to be useful?
>
>>How would
>>implementing whitening in microcode affect price? Could we trust the
>>whitening more if it were "in hardware" than in a driver?
>
>Insignificant differences in cost.
>
>If some function is implemented in metal and poly, packaged
>in epoxy, soldered in place, and carried on the person,
>its pretty tough to subvert without being noticed.
>
>If some function is code in alterable memory, you have
>to be a lot more careful about who you let play with
>it and who you connect it to.
Conspiracies are fun to talk about. Conspiracies regarding possible
ulterior motives by Microsoft or Intel are even more fun to talk about.
I worked at Intel in the 70s and 80s. One of my labs developed the
electron-beam probing systems used to debug the 286, 386, and later chips.
There are several likely reasons why Intel has not released details about
its RNG:
* they keep _many_ things as trade secrets. While we may decry and ridicule
this as "security by obscurity," in the real world it is important for
companies to keep secrets from their competitors. Delaying discussion of
the details will slow AMD down a bit in trying to reverse-engineer the RNG.
("Open source chips" anyone? Not for a long while. And to paraphrase Ken
Thompson's paper from the 80s about how a compiler could subvert any
system, what's the point of knowing how the RNG works if the chip itself
can do other things? There may be ways to compartmentalize and modularize
such functions so that subversion is not possible, but it ain't happening
today. Or anytime soon.)
* implementation details change. When people learn about "undocumented
features" they tend to get clever about bypassing the standard so as to eke
out a few more percentage points of performance (or more, as when
programmers bypass Microsoft's APIs and use video drivers directly).
I think these reasons account for most of the absence of details. It may be
that some technical papers will appear later.
In any case, I think it's much ado about nothing. Easy enough to stir in
entropy from an eclectic mix of sources (Intel's RNG, mixed with audio
inputs, mixed with junk pulled in from networks and disk access numbers,
some more bits from keys and mouse swirlings, etc.
Also, Intel would be foolish to put a "back-doored RNG" in, if even such a
thing could remain secret. (One of the several dozen engineers or managers
who attended meetings to spec out such a thing or test for it would
eventually blab, customers would eventually figure it out, etc.). The
explosive loss of reputation would dwarf the FDIV PR disaster of some years
back.
As for the hopes of reverse-engineering the RNG from probes, as mentioned
above, good luck! It's not the packaging and epoxy and whatnot that's the
limit, it's the many layers of metal used on today's chips. Our e-beam
probes ran into serious, serious problems when only 3 layers of metal were
in use: the probe cannot penetrate a conductor, let alone several
overlapping and stacked conductors.
Given a large and well-equipped lab, there are some ways to strip down and
probe interior gates, but this is a major undertaking. It was tough for my
lab to do this in 1984. I'm glad I no longer have to try.
--Tim May
Y2K: It's not the odds, it's the stakes.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May | Crypto Anarchy: encryption, digital money,
ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets,
"Cyphernomicon" | black markets, collapse of governments.
