[coreboot] call on AMD to release src+specs+datasheets for ryzen

[Nico Huber]

On 04.03.2017 17:54, Taiidan at gmx.com wrote:
> On 03/04/2017 06:39 AM, Nico Huber wrote:
> 
>> On 04.03.2017 02:57, Taiidan at gmx.com wrote:
>>> Of course they also must release the signing keys as well afaik, or we
>>> would be stuck at a tivo style not really open source impasse.
>>> Nobody has mentioned this fact in that thread.
>> Please don't ask for that.
>>
>> If somebody put a signature verification for his firmware in place, you
>> should first discuss the reasons and alternatives (for the particular
>> design in question). Sure there are alternatives to signature verifi-
>> cations to put some trust in hardware (like ROMs or the RO partitions
>> in cros devices). But removing the security checks from hardware who's
>> trust is designed around these checks? You'd likely end up with a sys-
>> tem where you have to check the flash contents with external hardware
>> before every boot (if it can be tampered with from the running system).
>>
>> Of course you can ask for alternatives in new designs.
>>
>> For yet released platforms, however, it's more feasible to ask for docu-
>> mentation, reproducible binaries and signatures (e.g. for fixes / reim-
>> plementations).
>>
>> Nico
>>
>>
> I am simply stating that source code is pointless without the ability to
> flash it and have the hardware execute it.

That's why I'd ask for documentation and reproducible binaries. You
could audit it then and wouldn't have to bother yourself with any fla-
shing.

> 
> The issue isn't that there are signing keys in the first place (which
> are common sense to prevent rogue BIOS updates) it is that the hardware
> enforces them for manual external flashes.

Correct. And that's why publishing the keys wouldn't solve the problem.
You'd just replace one problem with another.

> 
> Your idea isn't a free platform, it isn't owner controlled because you
> can't modify it

Yes, not a free platform. We are talking about AMD here. Releasing pri-
vate keys won't make it free. It would just make it less secure, IMO.
Btw. not my idea of any platform. Just my suggestion how to make cur-
rent platforms more trustworthy.

> - you can only be on the outside looking in.

Better nobody (including myself) can tamper with my system than every-
body.

Nico