The chip yes (probably), the firmware not so much. For the most part all those certification processes just slow things down and make it harder for people to actually implement modern best practices (instead of outdated ones). Silicon moves a lot slower than software.
-
This Tweet is unavailable.
-
This Tweet is unavailable.
-
ROCA took several years of research because the source code was closed and unauditable to third parties. There are plenty of cryptographers who would've raised an eyebrow at that code, and RSA keygen is one of the first things you look at for problems.
ROCA was so obvious once the finger was pointed at the problem area that I had friends who reverse engineered it through key analysis and guessed at what the bad code was doing, before the official research paper was published.
-
-
This is an endemic problem in parts of the industry, where half-competent people are the ones doing the audits, while access is denied to those who could actually find problems quicker (but might not work for a big auditing firm).
-
Big auditing firms excel at filing a lot of paperwork and certifying a lot of PowerPoint bullet points. They do not excel at finding actual problems. They might find some, but not nearly as many as would be found if the product were auditable at large.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.