Hector Martin

Auditability is great, but only if it brings more security! Auditability on a broken device only allows everyone to verify it's indeed broken... NDA for secure chips is not ideal, but vendors want to protect their IPs... Designing a secure chip is not easy!

Re NDAs, nonsense. That's all just either security by obscurity (fear of actual flaws being discovered by wider auditing) or corporate image BS. Making your programming spec public does not give away your silicon secrets, otherwise *no* IC vendor would do it.

It allows to understand how countermeasures are working...

No it doesn't. The programming spec is irrelevant for stuff like silicon voltage monitors and metal layer meshes, which are the kinds of things which actually provide environmental security.

Also, you're using the "security by obscurity" argument, which, even if the security is actually good, has been thoroughly discredited in the security industry, and silicon isn't a special case. I hope I don't need to give you a lecture on this, it's common knowledge.

I'm just saying they are protecting their IPs, I'm not saying it's a good thing...

Fair. I don't think they're actually accomplishing anything but... :-)

What I find not fair in the discussion is to induce the idea that using pwned circuit as they are open, is a better idea (security wise) than secure circuits as they are closed... I think it's a fallacy...