There is only one way digitally signed hardware layers can work: encryption. So if something is encrypted, you must have the key to decrypt it. If they key is encrypted by the signer, and the signer must verify authenticity before they will provide they key, then the end user us completely subject to the signer's mercy.

Microsoft will be the #1 CA, because they control the market. To ensure compliance, all providers will need to work with M$. Microsoft is a corporation and as such it follows economic dynaics to reach maximum profitability, reguardless of moral issues. Therefore it stands to reason that this technology will be abused to rob end users of their rights.

There is one key flaw: someone, somewhere will get they keys through dishonest means, and then provide a method of replicating them or reverse-engeneering the approval process so that unapproved hardware can run approved code and/or modified code can be resigned with approved keys.

And I see that as a bigger security threat than where we are now, especially if it takes a while for this to be done. The longer it takes the more likely it is that software will be written to take advantage of the hardware doing it's checking for it, and run damn near anything it comes across. Break the they keys and resign bad code as good code and it will replicate faster than Code Red.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/96/15718#15718