Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
News

AMI Introduces 'Trusted Computing' BIOS 626

Posted by michael from the here-it-comes dept.
An anonymous reader writes "American Megatrends announced its 'trusted computing' Palladium BIOS on Jan 6. It seems that the encrypted BIOS' integrity will be verified by a special chip or flash ROM, and will in turn verify the 'authenticity, integrity and privacy' of the boot loader and the operating system. Does that mean such machines may refuse to boot any other non-'trusted' OS? After all, the list of supporting corporations include AMD, Intel, IBM, and HP, of whom we heard quite favourable statements about Linux (just for example -- *BSDs will be equally affected) so far."
This discussion has been archived. No new comments can be posted.

AMI Introduces 'Trusted Computing' BIOS More

AMI Introduces 'Trusted Computing' BIOS

Comments Filter:
  • If you read the Inquirer www.theinquirer.net , they cover this announcement.

    A representative from AMI explains some of the ideas behind the Trusted Computing initiave.

    • I will never buy one of these systems in my lifetime.

    • Read the TCPA / Palladium FAQ (Score:5, Informative)

      by vinsci ( 537958 ) on Thursday January 09, 2003 @05:56PM (#5050555) Journal
      Ross Andersson [cam.ac.uk] at the University of Cambridge has written an excellent introduction to TCPA / Palladium, which explains both sides of the story.

      Read it here: http://www.cl.cam.ac.uk/%7Erja14/tcpa-faq.html [cam.ac.uk]

      The two last sections are worth repeating here:

      24. So why is this called `Trusted Computing'? I don't see why I should trust it at all!

      It's almost an in-joke. In the US Department of Defense, a `trusted system or component' is defined as `one which can break the security policy'. This might seem counter-intuitive at first, but just stop to think about it. The mail guard or firewall that stands between a Secret and a Top Secret system can - if it fails - break the security policy that mail should only ever flow from Secret to Top Secret, but never in the other direction. It is therefore trusted to enforce the information flow policy.

      Or take a civilian example: suppose you trust your doctor to keep your medical records private. This means that he has access to your records, so he could leak them to the press if he were careless or malicious. You don't trust me to keep your medical records, because I don't have them; regardless of whether I like you or hate you, I can't do anything to affect your policy that your medical records should be confidential. Your doctor can, though; and the fact that he is in a position to harm you is really what is meant (at a system level) when you say that you trust him. You may have a warm feeling about him, or you may just have to trust him because he is the only doctor on the island where you live; no matter, the DoD definition strips away these fuzzy, emotional aspects of `trust' (that can confuse people).

      Remember during the late 1990s, as people debated government control over cryptography, Al Gore proposed a `Trusted Third Party' - a service that would keep a copy of your decryption key safe, just in case you (or the FBI, or the NSA) ever needed it. The name was derided as the sort of marketing exercise that saw the Russian colony of East Germany called a `Democratic Republic'. But it really does chime with DoD thinking. A Trusted Third Party is a third party that can break your security policy.

      25. So a `Trusted Computer' is one that can break my security?

      Now you've got it.

  • War on terror (Score:5, Funny)

    by Anonymous Coward on Thursday January 09, 2003 @03:50PM (#5049266)
    This will go a long way towards the war on terror. Terrorists wont be able to install and use unauthorized OS's. This could potentially save thousands of lives.

    • Re:War on terror (Score:5, Insightful)

      by Anonymous Coward on Thursday January 09, 2003 @04:14PM (#5049475)
      Just like it is so difficult to buy a PC from a major vendor that does not already have Windows, they will also eventually try to make it impossible to buy one that does not have DRM on it which only allows you to run a policed DRM OS, read: Microsoft Windows.

      Fight this all the way. Intel didn't get it when they put the ID on their chips until we decided not to buy it. In the same vein, AMD won't get it that we don't want DRM until we (unfortunately, since I actually like them) tell them to go to hell.

      • Re:War on terror (Score:5, Insightful)

        by ReelOddeeo ( 115880 ) on Thursday January 09, 2003 @04:58PM (#5049928)
        Just like it is so difficult to buy a PC from a major vendor that does not already have Windows, they will also eventually try to make it impossible to buy one that does not have DRM on it which only allows you to run a policed DRM OS, read: Microsoft Windows.

        Given the current number of non-US governments (various South-American, Japan, Germany, UK ?, Malyasia, China, Tiwan, South Korea, Isreal, Pakastian, probably others I've forgotten in the frequent Linux Today announcements) jumping on the open source bandwagon...

        Given the Chinese governments' interest in developing their own microprocessors (Dragon? recently on Slashdot)...

        I don't think that the forces of evil can force every PC everywhere to have DRM.

        As long as some PC's can freely run any software, there will always be ways to defeat DRM. Or said differently, without total control, they control nothing.

        Given that there will always be somebody powerful enough that doesn't want DRM, or at least, wants Free software, the DRM folks will never get total control.

        • Re:War on terror (Score:3, Insightful)

          by kien ( 571074 )
          As long as some PC's can freely run any software, there will always be ways to defeat DRM. Or said differently, without total control, they control nothing.

          Right on. And even if you live in the US... remember that there are such things as soldering irons and oscilloscopes. Hey, you mastered Linux right? Comparatively speaking, the laws of Ohm and Kirchoff are n00b material. Even an AOL luser could learn! (Ok, that might be stretching things.) :)

          --K.

        • Re:War on terror (Score:3, Insightful)

          by geekee ( 591277 )
          Ahh, if you don't want DRM, don't run DRM based software. The hardware only does what the software tells it too do. There is nothing in the atricle claiming the BIOS will refuse to boot non trusted OS software.

    • Re:War on terror (Score:4, Offtopic)

      by Henry V .009 ( 518000 ) on Thursday January 09, 2003 @04:23PM (#5049550) Journal
      I think the slashdot moderators misunderstand the mechanics of slashdot meme creation. It all starts out with some inane, yet generally applicable, statement getting modded up to 5. It's read by tens thousands of slashdoters who imprint the idea on their psyche. From then on, there is usually at least one, but possibly several, posters who feel the need to update the comment for each new article--really the comment has gone beyond a simple joke for these poor souls, it becomes almost a mystical experience each time they post. I imagine it's almost like they are communing with their god. Simply the way the brain works. Christianity and Islam and Judaism all started out the same way. You start off with some nut with an seemingly inexplicable ability to influence large groups of people to do idiotic things, and suddenly you have a beowulf cluster of hot grits getting poured all over a dead BSD system. In soviet Russia, of course, it's the other way around.

      What I'm trying to say, I guess, is that memes are powerful things. So use your mod points for interesting and thought provoking posts relevant to the subject at hand. You don't have to mod a lot of stuff down, but show some restraint in modding junk up.

      I mean, do we really want the second coming to occur during in some long post about Natalie Portman and the basalt content of her nude body?
      • QUOTE:

        I mean, do we really want the second coming to occur during in some long post about Natalie Portman and the basalt content of her nude body?


        Ohhh, excuse me, while reading that, I just come - twice. - Does that count?

  • Not this time around... (Score:5, Interesting)

    by Kjella ( 173770 ) on Thursday January 09, 2003 @03:50PM (#5049270) Homepage
    Does that mean such machines may refuse to boot any other non-'trusted' OS?

    I'm pretty sure it won't. For now it'll just not have a trusted signature, so no access to Palladium-protected content. But I'm pretty sure that's the bait of a bait&switch operation...

    Kjella

    • Comment removed (Score:5, Interesting)

      by account_deleted ( 4530225 ) on Thursday January 09, 2003 @03:53PM (#5049289)
      Comment removed based on user account deletion

    • Re:Not this time around... (Score:4, Interesting)

      by briancnorton ( 586947 ) on Thursday January 09, 2003 @03:53PM (#5049294) Homepage
      Palladium as I understand it has NO APPLICATION for content protection. It's not a DRM system. It's a security function so that your hardware knows what it's doing. It will provide a level of security between applications, the OS, and hardware. You should never know that it's there.

      • Re:Not this time around... (Score:5, Insightful)

        by micromoog ( 206608 ) on Thursday January 09, 2003 @04:04PM (#5049393)
        You should never know that it's there.

        Provided you only use Palladium-approved hardware. And applications. And operating system. And you don't want to make your own software. Or MP3's.

      • Re:Not this time around... (Score:4, Interesting)

        by Tom7 ( 102298 ) on Thursday January 09, 2003 @04:19PM (#5049518) Homepage Journal
        Uh, then I think you understand. Palladium is designed essentially to prevent you from using debugging hardware or software to circumvent copy-control mechanisms. It is a key ingredient in the enslavement of the media consumer. What do you think it's for, and how do current OS techniques not address that?

      • Re:Not this time around... (Score:5, Interesting)

        by theLOUDroom ( 556455 ) on Thursday January 09, 2003 @04:31PM (#5049613)
        Palladium as I understand it has NO APPLICATION for content protection. It's not a DRM system.

        You clearly don't understand it at all then.
        Ask youself "Why do they need to add special hardware?" Everything you're saying it's for can be done via software.
        The point of Palladium is that you will not longer have "root" access to your own machine. The system is only going to trust "trusted" programs, but there's no way for you to decide if a program is trusted or not, is there? You don't get access to the key, this way the OS can stop you from running a program which copies that DRM-protected music file in the Palladium protected part of your hard disk onto a CDR. It pretty obvious that this system was designed for DRM.

    • Read the patent here (Score:4, Interesting)

      by jhantin ( 252660 ) on Thursday January 09, 2003 @04:12PM (#5049463)
      According to US patent 6,327,652 [uspto.gov] that is indeed correct-- unsigned code simply doesn't get any access to secured data, and may not even be allowed to run on the same desktop as signed code. If the boot sector doesn't pass the BIOS's signature check, it's not given access to the machine private key, and therefore can neither unlock locally stored encrypted content nor pose as a trusted system to other machines on the net. The only bait-and-switch here is the possibility of a concerted push by software or content producers to require a trusted runtime. One minor wrinkle is that this will require boot-selector programs like LILO [freshmeat.net] to either be code-signed or be unable to properly boot signed operating systems.

  • A distant rumble... (Score:3, Funny)

    by snowlick ( 536497 ) on Thursday January 09, 2003 @03:50PM (#5049271) Homepage
    All throughout the house, all the little creatures were stirring, preparing a flame war which would put all others to shame... The pyre would glow for nights, some said it could be seen from space...

  • What isnt stated (Score:3, Informative)

    by briancnorton ( 586947 ) on Thursday January 09, 2003 @03:51PM (#5049272) Homepage
    If you have a palladium processor and palladium motherboard, hard drive whatever, you arent going to be limited to a palladium enabled OS, you just wont be able to use the benefits of a palladium trusted environment. So said microsoft anyhow.

    • Re:What isnt stated (Score:5, Funny)

      by Anonymous Coward on Thursday January 09, 2003 @03:55PM (#5049316)
      One of the key benefits of Palladium, of course, being a PC that boots up! People will really embrace Palladium's "booting PC" feature when compared to the "non-booting PC" features of the competition!

    • Re:What isnt stated (Score:3, Insightful)

      by Syphonius ( 11602 )
      What benefits? Best I can tell, trusted computing provides me, a consumer, no benefits over what exist today. It does, however, provide many benefits to large corporations and media control companies.

      So 'trusted' here means that the companies can finally trust 'all us thieves' with 'their' media property.

      Explain to me again, why on earth would I want any machine like this as a general computing platform?

      • Comment removed (Score:4, Insightful)

        by account_deleted ( 4530225 ) on Thursday January 09, 2003 @04:14PM (#5049471)
        Comment removed based on user account deletion

        • I *guess* you're being ironic (Score:4, Insightful)

          by tkrotchko ( 124118 ) on Thursday January 09, 2003 @05:15PM (#5050113) Homepage
          "One file slips out and bamo - no one is paying for it anymore."

          Well, high-quality digital media with no copy protection has been sold for over 15 years and the people selling it made record profits last year.

          Its called the "compact disk". Perhaps you've heard of it? Phillips invented it, and it turns out that not only can you make copies for under five cents, you can compress them digitally to make files to store on any device.

          It may catch on.

      • Re:What isnt stated (Score:5, Informative)

        by harlows_monkeys ( 106428 ) on Thursday January 09, 2003 @04:37PM (#5049662) Homepage
        What benefits? Best I can tell, trusted computing provides me, a consumer, no benefits over what exist today

        How about better online games? Consider MMORPGs. To prevent cheating, they have to do various things server-side that would actually make more sense from a resource allocation point of view to do on the client.

        For example, DAoC has to handle stealth on the server, calculating who should be able to see a stealthed character, and only sending that character's positions to clients that should see him, so that people with DAoC's equivalent of ShowEQ won't see them. However, those people can still see people who are hiding behind trees or hills or buildings--it would be too much work for the server to do the visibility calculations for everyone.

        With a trusted client, they could just send the data on everyone in the area, and trust the client to not show what the player is not supposed to see.

        Or how about monster AI? The monsters could be a lot smarter if they could run the AI on the client, instead of on the server.

  • And how long before... (Score:5, Interesting)

    by Anonymous Coward on Thursday January 09, 2003 @03:52PM (#5049280)
    ...the first "trusted" bootsector virus appears?

    • Re:And how long before... (Score:4, Interesting)

      by doorbot.com ( 184378 ) on Thursday January 09, 2003 @05:38PM (#5050336) Journal
      But this is exactly the problem... if a virus manages to pass as a trusted program, then Palladium merely reverts back to the system we have today (except as a consumer you have less control over your own property). Viruses can still wreak havoc, etc. Once the trust is broken by one app, the whole system collapses.

  • No it doesn't. (Score:4, Informative)

    by Kickasso ( 210195 ) on Thursday January 09, 2003 @03:52PM (#5049285)
    If it's true to spec, it will load anything. Just not in the trusted mode.

  • Not necessarily for the masses (Score:5, Insightful)

    by Arcturax ( 454188 ) on Thursday January 09, 2003 @03:53PM (#5049292)
    This could as easily be for military computers as well as the great unwashed. So I don't think we will be seeing these in home PC's just yet.

    Not only that we don't know yet what OS they will work with. So lets not start doomsaying until the first of these are out and there is proof they refuse to run certain operating systems.

    • Re:Not necessarily for the masses (Score:4, Insightful)

      by sphealey ( 2855 ) on Thursday January 09, 2003 @03:56PM (#5049333)
      Not only that we don't know yet what OS they will work with. So lets not start doomsaying until the first of these are out and there is proof they refuse to run certain operating systems.
      Well, the problem is that the "embrace and extend" and "stealth networking" marketing techniques use the time when the victim, I mean the consumer and compeititon, is waiting to see what happens to lock everything in place and preempt any other course of action. So that may not be the best approach in this case.

      sPh

      • Plus, it's always possible that "the first of these" will come out running any OS; then the upgrade that is necessary to correct serious bugs will turn out to have the unadvertised side effect of locking out other OS'es; and only then will people notice that it said that might happen in fine-print legalese twenty pages down in the EULA.

        There's a lot of precedent for this. (Ask anyone who took advantage of the upgrade deal on their REB1100 eBook device, for example). Its predecessor, the Rocket eBook let you download your own content into the device. The REB1100 was only advertised as allowing the download of purchased content, but actually permitted download of personal content too. Then a "stealth" upgrade removed that feature.

    • Comment removed (Score:5, Informative)

      by account_deleted ( 4530225 ) on Thursday January 09, 2003 @03:57PM (#5049337)
      Comment removed based on user account deletion
  • It seems that the encrypted BIOS' integrity will be verified by a special chip or flash ROM, and will in turn verify the 'authenticity, integrity and privacy' of the boot loader and the operating system.

    Going by the above statement, one could interpret it as meaning you need a digitally signed bootloader... is this going to be a problem? (OSS that is).

    • Yes. (Score:2, Insightful)

      by Kickasso ( 210195 )
      No lilo/grub/whatever for you! Unless distro vendors will somehow manage to sign their binaries. For dual-boot you'll need to resort to diskettes or other such sillyness.

  • Yeah, so I'm offtopic (Score:5, Funny)

    by Chocolate Teapot ( 639869 ) on Thursday January 09, 2003 @03:54PM (#5049301) Homepage Journal
    "American Megatrends" appears to be an anagram of "reincarnated smegma". Just felt the urge to share that,
  • From what I understand, yes but I may be mistaken since I'm working from a hazy memory here. I believe it can be turned off just like DRM. I would imagine that Windows (later versions) probably won't run without it turned on.

    Of course, it entirely feasible that one could be running a Linux distro that has jumped through all of the hoops to become certified "trusted".

  • Q: One BIOS only? (Score:3)

    by 4of12 ( 97621 ) on Thursday January 09, 2003 @03:54PM (#5049304) Homepage Journal

    So, with my limited understanding, I think of this thing running the BIOS through a one-way hash and comparing it to what's written in stone on NVRAM.

    Doesn't this mean that you cannot upgrade the BIOS?

    Or, that any "upgradeability" is tantamount to leaving a door open to unauthorized "upgrades" to the BIOS?

    TIA.

  • Trusted to do what? (Score:5, Insightful)

    by TheSHAD0W ( 258774 ) on Thursday January 09, 2003 @03:56PM (#5049323) Homepage
    The original Palladium spec calls for a trusted machine to only allow trusted access by trusted operating systems. This means Palladium-encrypted code won't run except under a Palladium-rated OS. If the OS isn't trusted, then no Palladium-enabled programs can run.

    This will mean that WINE will be useless for many future Windows apps, especially those dealing with multimedia. It also means future versions of Windows will be written specifically to defeat applications like VMware, so as to not violate the security.

    These are bad, though they don't prevent one from booting a non-Palladium-enabled OS and using alternative applications. What I keep worrying about is the TCPA *2.0* specification. The original spec allows an alternative to a "trusted" platform, but future specs may require a PC boot a Palladium-enabled OS -- or none at all.
  • Will there be hardware produced that is locked to specific operating systems?
    Will it not be able to bot multiple operating systems?
    I know those companies mentioned have supported GNU/Linux so I doubt they will start making strictly windows only hardware. But what are the immediate effects we can expect to see when this becomes a little more prevalent?
    And what will be the long term effects? Will I be able to boot the Hurd when it's released?

  • Congratulations, AMI (Score:3, Interesting)

    by SupahVee ( 146778 ) <supervNO@SPAMmischievousgeeks.net> on Thursday January 09, 2003 @03:57PM (#5049338) Journal
    You've just lost one customer, from this point forward, no matter how difficult it may be for me to find other products, I will not buy ANY hardware that contains a BIOS made made by your company.

    WHile this may not seem like a big deal, I _am_ in the market for a new system, and have a decent budget to do it with.

  • Maybe I am dense... (Score:5, Interesting)

    by gosand ( 234100 ) on Thursday January 09, 2003 @03:58PM (#5049343)
    Am I just stupid? How come I don't really see the benefit of this? Sure, the BIOS checks to see that the OS and hardware are "trusted", but what does this really buy you? So it says: OK, we have an official copy of Windows XP installed. Does this mean that the system is now secure? Hardly. What would something like this, even if it worked flawlessly, protect the user from?


    I honestly don't understand the value (or perceived value) in having this.

    • It will enable you to get DRMed content. (Score:5, Informative)

      by Kickasso ( 210195 ) on Thursday January 09, 2003 @04:02PM (#5049372)
      That's it. A remote site can know whether or not you're running a trusted (IOW "unhackable") OS/apps. If you do, they'll send you decryption keys for playback and be reasonably sure you won't intercept them, store them permanently etc.

    • Re:Maybe I am dense... (Score:5, Insightful)

      by MrWa ( 144753 ) on Thursday January 09, 2003 @04:17PM (#5049503) Homepage
      So it says: OK, we have an official copy of Windows XP installed. Does this mean that the system is now secure? Hardly. What would something like this, even if it worked flawlessly, protect the user from?

      No, you aren't dense...just fooled by the doublespeak that Microsoft and the like use when describing this type of Digital Restriction Mechanisms. You aren't supposed to trust the hardware or software - this system is not being created to protect the user from anything. The intent is to protect developers (of software or media) from the users.

      Think of it as a way for Microsoft to write an OS - however buggy and insecure you like - and, supposedly, have the ability to run programs and display media with the knowledge that it is secure from being manipulated or used by the user in a way that Microsoft does not want.

  • From the Trusted computing [trustedcomputing.org] website:

    Is the TPM based platform limited to a particular operating system or microprocessor?

    No. The TCPA specification is designed to be platform and OS agnostic. The TCPA specification is not limited to a specific platform, OS or CPU.

    The specifications are available for download free from trustedcomputing.org [trustedcomputing.org] - Any linux distro should be able to take advantage of them.

    Its up to you to decide if you want to trust it or not, but that's what their website states.

    • Not so fast (Score:3, Informative)

      by vinsci ( 537958 )
      At least two companies have started working on a TCPA-compliant version of GNU/Linux.

      So, is there a problem? Yes, there is. You can't modify the kernel. If you try, it will not be trusted by the TCPA chip and so no application running on that kernel can gain access to any feature, media or application that requires TCPA. Certifying a Linux kernel (or any other OS) as TCPA-compliant is expensive and you would need to do it for every modification of the kernel. What value is the GPL if you can't use the source to create your own kernel?

      Ross Anderson's TCPA / Palladium FAQ [cam.ac.uk] has a more detailed discussion (excerpt from section 18):

      [TCPA hardware is referred to as the "Fritz chip" in the FAQ]

      TCPA will undermine the General Public License (GPL), under which many free and open source software products are distributed. The GPL is designed to prevent the fruits of communal voluntary labour being hijacked by private companies for profit. Anyone can use and modify software distributed under this licence, but if you distribute a modified copy, you must make it available to the world, together with the source code so that other people can make subsequent modifications of their own.

      At least two companies have started work on a TCPA-enhanced version of GNU/linux. This will involve tidying up the code and removing a number of features. To get a certificate from the TCPA corsortium, the sponsor will then have to submit the pruned code to an evaluation lab, together with a mass of documentation showing why various known attacks on the code don't work. (The evaluation is at level E3 - expensive enough to keep out the free software community, yet lax enough for most commercial software vendors to have a chance to get their lousy code through.) Although the modified program will be covered by the GPL, and the source code will be free to everyone, it will not make full use of the TCPA features unless you have a certificate for it that is specific to the Fritz chip on your own machine. That is what will cost you money (if not at first, then eventually).

      You will still be free to make modifications to the modified code, but you won't be able to get a certificate that gets you into the TCPA system. Something similar happens with the linux supplied by Sony [playstation2-linux.com] for the Playstation 2; the console's copy protection mechanisms prevent you from running an altered binary, and from using a number of the hardware features. Even if a philanthropist does a not-for-profit secure GNU/linux, the resulting product would not really be a GPL version of a TCPA operating system, but a proprietary operating system that the philanthropist could give away free. (There is still the question of who would pay for the user certificates.)

      People believed that the GPL made it impossible for a company to come along and steal code that was the result of community effort. This helped make people willing to give up their spare time to write free software for the communal benefit. But TCPA changes that. Once the majority of PCs on the market are TCPA-enabled, the GPL won't work as intended. The benefit for Microsoft is not that this will destroy free software directly. The point is this: once people realise that even GPL'led software can be hijacked for commercial purposes, idealistic young programmers will be much less motivated to write free software.

  • I hate to say it (Score:3, Funny)

    by jayhawk88 ( 160512 ) <jayhawk88@gmail.com> on Thursday January 09, 2003 @04:00PM (#5049362)
    ...but does this mean *BSD really is dying, and all those trolls have been right all along?

  • Trust whom? (Score:5, Interesting)

    by bytesmythe ( 58644 ) <bytesmytheNO@SPAMgmail.com> on Thursday January 09, 2003 @04:02PM (#5049373)
    Just follow this little (hypothetical) chain of events:

    1) BIOS on new motherboard will only go into "Palladium-mode" if you're booting a "trusted" OS. For the time being, you can still run linux, but it won't have access to any "Palladium" features.

    2) If you're running a "trusted" OS (eg. MS Windows UY [Up Yours]), the OS can hit the 'Net and automatically download and apply updates to itself. At some point, it could quite easily detect the BIOS on your system and apply an update so that...

    3) The BIOS will no longer boot non-trusted systems. Also...

    4) The OS could download a new protocol stack that could render it inoperable with other protocols. An entire new Internet based on the MSOY/BO (Microsoft Ownz You/Bend Over) protocol could spring up almost over night. MS-only network services, online shopping, etc.

    Is any of this likely to happen? I don't know. But it would be possible, and I'm not sure I trust Microsoft not to try it. Even if Open Source doesn't relegate MS to the /dev/null of the computing industry, the OS community is going to need each other to maintain a DRM-free computing zone. Open source, open protocols, open formats, open beer.

  • BIOS features (Score:4, Interesting)

    by erroneus ( 253617 ) on Thursday January 09, 2003 @04:04PM (#5049397) Homepage
    I think this reminds me of the situation with the CPU IDs in the Intel Pentium processors. I have yet to see a BIOS supporting such processors without the ability to disable the serial number.

    I suspect that the "trusted computing" features will be similar it its ability to disable such things. It will be required of virtually every motherboard manufacturer who wants to compete. I can't imagine hardware manufacturers being pressured into making a palladium only system.

    • Re:BIOS features (Score:3, Interesting)

      by FreeUser ( 11483 )
      I think this reminds me of the situation with the CPU IDs in the Intel Pentium processors. I have yet to see a BIOS supporting such processors without the ability to disable the serial number.

      Yes, but Intel CPUs allows software to reenable the serial number at whim, so even though you've turned it off the BIOS, MS Spyware is still able to read it and stamp in onto every video library file you make, or even view, if it so desires.

      The BIOS setting was a public relations gesture, with no real substance, and no protection for the consumer from exactly the sorts of abuses the public outcry against the feature engendered in the first place.

      I suspect that the "trusted computing" features will be similar it its ability to disable such things. It will be required of virtually every motherboard manufacturer who wants to compete. I can't imagine hardware manufacturers being pressured into making a palladium only system.

      I suspect you're right ... it will be very like the CPU ID. You'll be able to turn it off in BIOS, and Microsoft SpyOS (or Real Networks SpyViewer for Linux) will turn it right back on again, right behind your back.

      Worse, as another noted quite insightfully, Version 2 may not allow non-compliant OSes to boot at all. Goodbye FreeBSD, goodbye GNU/Linux, goodbye Free Software, goodbye Freedom. At least in the western world ... China, Taiwan, and India will likely find a very receptive market in the rest of the world to a non-Palladium platform still capable of running GNU/Linux or FreeBSD ... and the Palladium/DRM infected nations (USA, Australia, perhaps Europe) will be relegated to a technological backwater before the century is even half gone.

  • Ahem. (Score:3, Insightful)

    by labratuk ( 204918 ) on Thursday January 09, 2003 @04:05PM (#5049404)
    That's one type of motherboard I won't be buying.

  • Tell them what you think! (Score:5, Interesting)

    by Tom7 ( 102298 ) on Thursday January 09, 2003 @04:14PM (#5049479) Homepage Journal
    I told AMI (link in the article: marketing@ami.com) that I don't think of this as a "feature". Computer manufacturers have backed down on much less invasive technologies (Pentium III's unique ID, for instance) before; I'm still a little bit hopeful that with all the competition in the mainboard scene we might be able to convince manufacturers not to adopt consumer-hostile technology like this.
    • I'm still a little bit hopeful that with all the competition in the mainboard scene we might be able to convince manufacturers not to adopt consumer-hostile technology like this.

      I got a new DVD player for Christmas. An APEX 3201. So far, I love it. I just eject the tray, press 8 4 2 1 on the remote, and get a secret menu. From here I can choose whether or not I would prefer Macrovision, and which region I would like, or can select All regions. (Sort of like asking, would you like to be kicked in the balls or not?)

      (Hint to stupid moderators: this post is NOT offtopic!)
    • AFAIK, the PIII ID is still there, and a while back AMD said they'd add it to theirs, tho I can't remember if we convinced them not to...

  • Windows incompatibility (Score:3, Funny)

    by Ilan Volow ( 539597 ) on Thursday January 09, 2003 @04:15PM (#5049489) Homepage
    If it can only run operating systems that can be trusted, how the hell am I going to be able to get it work with Windows?

  • DRM DRM DRM (Score:3, Interesting)

    by rutledjw ( 447990 ) on Thursday January 09, 2003 @04:22PM (#5049544) Homepage
    I keep hearing that this is NOT just about DRM but for all applications. Really? What software vendor is going to implement any of the TPCA features EXCEPT for the media industry?

    Is Oracle, BEA, IBM or any of the OSS projects going to do this? For what? What value is brought by wasting time and money implementing a strategy that has little or no benefit to the customer?

    Bah, this is a scarcely concealed attempt to appease the media giants (the people who FUND RIAA). Lack of customer interest will likely cause this to fail.

    • Companies implement TPCA at cost $X
    • Customers don't want / use
    • Competitor undercuts companies implementing TPCA because they don't waste their $$$ on it
    • TPCA meets it appropriate fate

    But what do I know? My company (who's in a "budget crunch") burns enough cash to single-handedly cause global warming, and we're profitable. Whatever, I'm going back to Oz where things make sense...

  • Blarf ... (Score:3, Informative)

    by halftrack ( 454203 ) <jonkje@gmailLION.com minus cat> on Thursday January 09, 2003 @04:26PM (#5049574) Homepage
    When are people going to get this into their thick sculls. Hardware doesn't make anything cryptographicly more secure, or check signatures better. Hardware crypto is just a hardware implementation of software crypto, just as software crypto is a digital implementation of math crypto. Anything created by humans can (and will) be broken by humans, bulletproof isn't possible. This will be broken, either to highly advanced hardware decomposition and reverse enginering or simply by brute force. Don't think it won't be possible to fake a certificate or signature or even hardware. Those with will, guts and/or need will do so. Hardware is just an expensive form of security through obscurity.

  • Black boxes (Score:5, Funny)

    by vidnet ( 580068 ) on Thursday January 09, 2003 @04:30PM (#5049609) Homepage
    These new "features" scare me. From what I gather, it's a roll of duct tape to further seal the black box computer. I've never liked devices that function according to ye olde proprietary model:

    1. Input
    2...499. None of your your damn business
    500. Output

    "Trusted computing", hah! Sure, the apps might trust each other and the system, but I won't!

  • Trusted Computing (Score:4, Informative)

    by evenprime ( 324363 ) on Thursday January 09, 2003 @04:35PM (#5049648) Homepage Journal
    Everyone on /. seems to be thinking about the potential for this to be used in DRM or religious wars about OS. Those are valid concerns. It is worth pointing out, though, that this BIOS has the potential to be used for less nefarious purposes; i.e. trusted hardware systems can be part of trusted platforms, which most security practitioners believe to be more secure. The idea of trusted hardware has been around at least as long as the Orange Book has existed. Specifically, it said:
    Now, whether or not trusted systems actually are more secure is a different issue.

    • Re:Trusted Computing (Score:3, Informative)

      by JoeBuck ( 7947 )

      Right, but the military (the authors of the Orange Book) are operating from similar assumptions as Hollywood: the operator of the machine is considered an untrustworthy person whose behavior must be carefully controlled. In this context, he or she must be prevented from bypassing operating system checks. Military multi-level security is also a form of DRM, and seeks to restrict even the most "trusted" users. And this may be entirely appropriate in many circumstances.

      The question is whether the purchaser of a machine is entitled to the equivalent of root or administrator privilege on the machine he or she owns, or whether the true administrator of the machine will live in Redmond or Washingon DC or Hollywood.

  • evil (Score:5, Insightful)

    by mao che minh ( 611166 ) on Thursday January 09, 2003 @04:38PM (#5049682) Journal
    Realize first that this technology is being billed as "trusted computing". Then realize that it is Microsoft Corporation pushing it. This should ring out ALARM YOU IDIOT! by itself. I'm not saying this because I am some kind of "Microsoft basher", as fat nerds like to call us sensible techie folk. I am saying it because there is no other truth.

    Microsoft is not interested in your security. Microsoft doesn't even much care about their own security, as long as the license is already paid for. They only want to make money and lock you into long term deals. The massive and drastic tactics by Microsoft to lock consumers into their platform indefinately is because there is actual competition (Linux, and an invigorated Macintosh) now. It is so plainly obvious that it stuns the senses.

    History should already be telling the world never to trust anything from Microsoft.

  • If our worst nightmare comes true... (Score:5, Interesting)

    by hkmwbz ( 531650 ) on Thursday January 09, 2003 @04:42PM (#5049715) Journal
    There will always be ways to crack protection mechanisms. I don't know what this new BIOS will mean, but it seems most people here fear that this is another step towards not having control of your own system.

    Well, I am worried about the development too, but at the same time, I think we must realize that no matter what they throw at us, someone will crack the protection.

    Ultimately, the entertainment industry will only be able to control individuals who allow themselves to be controlled.

    The rest of us will actively seek solutions that remove us from the evil claws of "Digital Rights Management", or rather "Consumer Ass Ramming" as it should really be called.

    They can encrypt and protect all they want, but someone will come through. Someone will work constantly on giving us our rights back - even if it means doing so illegally.

    If it becomes illegal to have control over one's own system and play off whatever one pleases, I will stand in line to break the law. Constantly. The more they try to control me, the more I will break laws.

    I am not saying that people's concerns about violated rights to control one's own system is not justified. I am just saying that we will prevail in the end. With the incredible amount of brainpower available to those with a liberal mind, the entertainment industry may win over the sheep who do not realize what is happening, but they will not get the ones that don't want to be ass-rammed.

    Sorry for the rant, but hopefully someone else agrees that the fight is far from over, and no matter what they tro to do, we will continue to fight...

    • Re:If our worst nightmare comes true... (Score:4, Insightful)

      by dusanv ( 256645 ) on Thursday January 09, 2003 @06:13PM (#5050682)
      Ultimately, the entertainment industry will only be able to control individuals who allow themselves to be controlled.

      Sure. And the rest of us are going to legally become criminals for hacking our own machines (see: DMCA). Wanna go to jail? I'll be dead before I put out a penny for any type of hardware that contains DRM. Go milk someone else...

  • Don't lose sight of the purpose (Score:5, Interesting)

    by JoeBuck ( 7947 ) on Thursday January 09, 2003 @04:48PM (#5049813) Homepage

    This technology is intended to support the TCPA 1.0 specification for "trusted computing". What "trusted computing" is supposed to mean is that if a file has a label on it saying "don't copy me", then it is in principle impossible for the user to copy the file (other than in the ways permitted by the digital "rights" management label).

    Once you understand this, you'll see that the purpose is quite clear: of course boxes equipped with this BIOS will refuse to boot Linux. That's the whole point; they will be intended only to boot operating systems that strictly support DRM. Each machine will have unique "integrity tokens" which can be used as digital signatures, so that everything you do on the machine (create a document, contact a web site) can be traced. Since you'll have to pay for your downloads on a credit card, this can all be cross-correlated. The integrity tokens will be digitally signed by the manufacturer, so that any action taken on the net by the owner of one of these beauties can, at least, be traced to the original purchaser of the machine. Secret, DMCA-protected protocols will assure that only "trusted computers" can connect to their web sites.

    Now, of course, initial implementations of this concept are likely to have flaws that can be exploited by crackers (example: find some way to write a program that replaces the "trusted" OS with a BSD or Linux kernel; reprogram the flash chip to disable checks), but I fear that they will get it right eventually.

    At some point, then, the net will bifurcate: there will be a world of glorified DVD players calling themselves computers interacting with restricted network sites, and a world of general-purpose computers interacting with sites that follow standard protocols. Attempts to outlaw the "free world" will not succeed because it will do too much damage, but those who participate in the "free world" will be viewed with suspicion, called pirates, etc. ISPs might be pressured into refusing to connect with "untrusted" machines.

    After five years or so, though, I expect the whole thing to fall apart, because countries that don't go along with this brain damage will acquire a technological lead, as the US enters an era where computer science is treated the way that the USSR treated science: dangerous state secrets not to be shared.

  • My take. (Score:5, Interesting)

    by Anonymous Freak ( 16973 ) <anonymousfreak@i ... inus threevowels> on Thursday January 09, 2003 @04:51PM (#5049846) Journal
    Okay, my take, based on working knowledge of 'trusted' computing and hardware design (I used to be a support enginner in Intel's server division,) is as follows:

    'Trusted computing' relies on the fact that every component is known to be secure. Of course 'secure' is a cagey term, but in this case, it means that the end application knows that nothing is interfering with it. The uses vary, from DRM to financial transactions, to other uses we haven't thought of. But, there are three main pieces in a trusted system:

    1. The hardware. The hardware needs to be 'trusted' in that we are certain that there is no hardware tampering or eavesdropping going on (of course, this applies only the the internals of the computer, a packet sniffer, or even a keyboard monitor, would be external, and ouside the scope of monitoring,) and to make sure that the machine is the machine it's supposed to be. This really started with Intel's Pentium III adding a processor serial number. The point of that (as with Palladium) was that each machine could be positively identified. If you had previously made that computer 'trusted', then set it so that only trusted machines could perform a said transaction, we could guarantee that the end user is who he says he is, from a hardware standpoint. This new BIOS is much the same way. Each board with this BIOS will be able to say "Yes, I am the motherboard that was here when this software was installed, so yes, I am the same computer." Obviously, this has implications for hardware failure, even moreso than Windows XP's activation problems.

    2. The OS. The OS must have support for trusted computing. It must be able to partition off the 'trusted' applications from the untrusted ones. It must be able to encrypt the contents of the drive, and only allow trusted applications to access protected data, and only allow trusted applications to access the 'trusted' part of memory. (So as to disallow one program from sniffing the program files, memory, or data transport streams of a protected application.) This would probably see alot of use by multiplayer online games, as they could make certain that no third-party applications that reside on the game-running-PC could be used to cheat. (As with some of the 'god map' programs for Everquest.) Again, this does not protect the data stream once it leaves the computer, an encrypted network connection would be required. Obviously, for the OS parts to work, users must log in to the system with a username and password at least. Biometric security would be better, so as to more certainly guarantee that the user is who he says he is.

    3. Applications. The entire purpose of 'trusted computing' is the applications. Applications that need to know that the user is who he says he is, and that is done by both the OS and the hardware. As with the game example above, other uses are financial transactions (for example, you could set it so that only your computer has access to your bank account records, so that even if someone stole your hard drive, and your username and password, they still wouldn't be able to get at your data,) and DRM. It makes a perfect DRM vehicle, as now the labels can enforce the one-computer rule. A downloaded file would refuse to play without the original application, OS, and hardware.

    The question is if these systems can boot a non-trusted OS? Of course they can! You won't be able to use trusted features (for example, your bank's online account access wouldn't work,) but you could use it just fine for applications that don't use MS' Palladium. Just like the Pentium III's serial number could be disabled, and all you lost was access to the (very few) programs that required it.

  • No Big Deal, Right? (Score:4, Interesting)

    by 9jack9 ( 607686 ) on Thursday January 09, 2003 @04:54PM (#5049891)
    For those of you consider this is no big deal, consider the following.

    Let's say the Microsoft Watch is a big success. Go ahead and laugh. They've got the bucks to seed these sorts of things into the marketplace for years. Eventually something will stick. If not the Watch then the MS Clock or the MS Hairdryer or the MS Refrigerator, or something.

    Now, let's say you, as a geek, have reprogrammed the thing so that it runs FreeWatch, the oss embedded watch OS that does all the cool stuff you want it to.

    The next version of the MS Watch is Trusted. It only runs approved software. It only runs approved services. And if it doesn't recognize the os and the software, it just doesn't run. Of course, approved means approved by Microsoft, or by the Watch Software Consortium. And they'll be happy to add FreeWatch, for $500 million and a 25% cut of the profits.

    If you don't think that's the way it will work, think again, very carefully. It isn't Trusted to Microsoft until it's utterly predictable. It will only run MS-approved software. It will only display MS colors. Once it's utterly predictable, then support costs go down, service fees go up, and 3. Profit!

    Now, extend that to the PC platform. Microsoft's stated goal is for computers to be as predictible as kitchen appliances. That means they run exactly the way it runs. Support costs go down, service fees go up. Paladium, TCPA, DMCA, DRM, it's all the same. It is to give you absolutely reliable computing. To end hacking, cracking, viruses, tinkering, end-user encryption, and everything else most geeks hold near and dear. And incidently, to put the hands of the electronics and entertainment industries into your wallet, forever.

    If you think this is unlikely, as yourself, why is the membership list of the TCPA secret?

    Maybe you still don't agree with me. Maybe I'm wrong. I really hope so. But perhaps it's worth keeping an eye on things.

  • Nothing to worry about... (Score:3, Funny)

    by Eric Damron ( 553630 ) on Thursday January 09, 2003 @05:04PM (#5050001)
    Hey I just got a prototype of the trusted computing BIOS. It's not so bad. As far as I can tell I can do all the things that I use to.

    No one is controlling my hardware but me. I still worry about the way that Microsoft is &$^^ *$(#@) ()%)$! but other than that it's not too bad.

    Oh yeah and I still have concerns about how the government is )^%$ $^*** $#*%$ &^. (&$# %$*@% (^% . But I'm sure we'll be able to stop that.

    We do need to watch the entertainment industry also because they're still trying to #@*^ %#^ &$ (&$%)*%.

    Yep these new BIOS are nothing to worry about.

  • TCPA != Palladium (Score:3, Informative)

    by Chris Colohan ( 29716 ) on Thursday January 09, 2003 @08:47PM (#5051616) Homepage
    PLEASE go and read about both TCPA and Palladium before flaming them. They are NOT the same thing. Really.

    Both TCPA and Palladium are ways of achieving "trusted computing", which is the ability for a program to run in an environment where the program knows (and can certify to people other than the computer's owner) that no other unwanted software is monitoring or modifying its actions. But how they are implemented is quite different.

    TCPA uses a secure boot process. The BIOS verifies that the boot block is trusted; the boot block verifies that the os kernel is trusted; the kernel then verifies the trust level of specific applications; etc. This is what this BIOS implements. The main feature of TCPA (in my mind) is HARDWARE SIMPLICITY -- all that is needed is a small extension to the BIOS which modifies the boot process.

    Palladium is from Microsoft, and it shows. Palladium is designed to start up in already running copy of pretty-much-unmodified Windows. Loading the Palladium subsystem (now known as a nexus) is supposed to be fairly easy, sort of like loading a device driver. But to get this ability they PAY with hardware complexity -- the CPU itself has to be changed so that the address space of the nexus can be partitioned, so it is not visible to or under the control of the main Windows kernel. This is one of many reasons why you don't see any Palladium enhanced systems in the real world yet -- Intel (or AMD) has not yet started selling a chip which supports what Microsoft needs to make Palladium work. A main design goal in Palladium seems to be "don't mess with Windows, we don't want to break legacy code".

  • I wrote AMI and this is their response (Score:4, Informative)

    by LittleLebowskiUrbanA ( 619114 ) on Thursday January 09, 2003 @09:12PM (#5051761) Homepage Journal
    Thank you for taking time to contact us here at AMI. We are sorry to hear
    of your decision to not seek out an AMI solution for your next purchase.
    While we respect your right to make that decision we would like to take a
    minute to underline some relevant points about our announcement that were
    not adequately conveyed in the "article" posted on Slashdot. We urge you to
    please give us a minute of your time to fully understand what AMI is
    offering and thus be able to make a fully informed decision.

    It must be noted that AMI has not announced support for Palladium. Palladium
    is an initiative by an OS entity that is slated for the future. To be
    honest, though we do know about it, AMI has not begun any development
    related to it. At this point we have not made any decisions on support
    either.

    TCPA does not equal Palladium. While certainly there is some future
    development overlap between the two, TCPA is being introduced by OEM's as a
    security option to protect systems through hardware and firmware. This
    feature is completely optional to our customers (OEM's, ODM's, CM's and
    other system builders) that they may choose to make it available or not
    depending on the needs of their market. We have had requests from a number
    of customers for this technology.

    Regarding the limitations of a system with TCPA I would offer the link below
    to the public specification for further information on compatibility with
    different OS's, and hardware. Based on that spec we can tell you that it
    does not limit the ability to run Linux (or any other open source solution).

    As a smaller company itself, AMI has always supported innovation and
    creativity as these have been our main tools in competing against much
    larger companies in our industry. We would not do anything that in our
    minds would damage our credibility or reputation for world class BIOS
    solutions and will carefully evaluate this type of feedback when it does
    come time to examine any future technologies. We would also like to
    recommend that anyone who is opposed to a Palladium-type solution in the
    future, please make that known to OEM's and system builders. As they are
    our customers, we definitely listen to them in terms of what they (and
    hopefully their customers) will want in future BIOS.

    Thank you again for your time in contacting us and we hope that this and
    some of the links below will shed some light on AMI's plans.

    LINKS

    Original Articles on theinquirer.net

    http://www.theinquirer.net/?article=7089
    http:/ /www.theinquirer.net/?article=7103

    AMI TCPA module Whitepaper
    http://www.ami.com/support/doc/TCPA_wh itepaper.pdf

    TCPA Website

    Basically wrote them and told them I wouldn't be buying from them from now on. I would reckon this looks like the company is receiving a bit of angry emails from people who build their own computers and/or are involved in the computer industry.
    Maybe they're worried about what WE think!? Nahhh...

  • Maybe Gigabyte's Dual BIOS could fit here (Score:3, Informative)

    by joeflies ( 529536 ) on Friday January 10, 2003 @03:53AM (#5053299)
    Gigabyte offers mobos that support two bios copies. It's there to provide BIOS failover (not that I've ever, ever had a problem with BIOS failing), but perhaps it could be adapted to allow dual-boot bios between Palladium and non-Palladium OSs. Tom's hardware explains Gigabyte Dual Bios [tomshardware.com]

Slashdot Top Deals

Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!

Close