March 16, 2005

Hardware security sneaks into PCs

From CNet:

Largely a footnote in 2004, the technology is set to take off this year, with the top 3 PC makers shipping laptops and desktops equipped with hardware security. Dell, the last holdout, announced that it had added the security technology to its latest line of notebooks on Feb. 1. In 2005, more than 20 million computers will ship with the trusted platform module, up from 8 million in 2004, according to estimates from research firm IDC.

The technology locks specialized encryption keys in a data vault--essentially a chip on the computer's motherboard. Computers with the feature can wall off data, secure communications and identify systems belonging to the company or to business partners. That means companies can improve the security of access to corporate data, even when the PC is not connected to a network.

Posted by rshah at March 16, 2005 07:22 AM

Trackback Pings

TrackBack URL for this entry:
http://www.rajivshah.com/~rshah/directory/mt-tb.cgi/22

Comments

The problem is that this "security hardware" is designed to be secure *against the owner*. The security chip contains a secret key and the specification requires that the owner is forbidden to know his own key. The specification requires the chip to self destruct if you attempt to get at your key. The specification requires that certain catagories of your files be irretrievably destroyed if the chip glitches, and any backup copies of those files be unusable. The chip acts as a spy watching and reporting on your hardware and software. The key inside the chip is used to lock these spy reports so that you cannot control thier contents or alter them. This spy report is called Remote Attestation. Once the 'security' system is activated it can restrict how you can use your computer and prevent you from reading or modifying your own files and software. The files become unreadable and unalterable except through the original software, and if you attempt to modify the software the security chip forbids you to read your files.

It is fundamentally a DRM enforcment platform.

There are a few non-DRM benefits the system can offer, but you could get all of these benefits from an identical system where the owner was permitted to know his master keys. With identical hardware such a system would have identical capabilities and would provide you with the same security benefits. The difference is that if you know your keys you retain full control over your computer. If you know your key you cannot be locked out of your own files. Unfortunately the specification forbids you to know your key. The specification is designed to secure your computer against you.

Posted by: Name at April 15, 2005 06:45 AM

Post a comment




Remember Me?