1. 14

  2. 7

    In a rare event, I actually like what I see here. They’ve clearly studied prior designs in high-security space, likely HSM and smartcard mitigations. The mesh enclosure strategy was adopted by older HSM’s. There were potential bypasses that led to even more features, esp membranes and radiation sensors. The best ever made, per Ross Anderson’s team of talented IC breakers, was IBM’s 4758 whose protections and potential attacks are described here:


    Best route is just to clone that thing somehow. IBM themselves already depreciated it in favor of a new product. Might still try to patent sue you or pull some other crap but worst case should be Chinese clones becoming available after new design is published. :) Designers of ORWL should try to copy more of the IBM thing’s techniques to close gap between the two.

    Far as design itself, I like that it’s relatively simple, leverages a secure IC, easy to disassemble, will allow low-level modifications like firmware, and can run standard software. The next step will be a model that replaces the Intel chip with OpenSPARC, OpenPOWER, or RISC-V multicore with added components for trusted boot or I/O protections. Some are available with some coming online. Next step is using crypto to protect confidentiality & integrity of anything leaving SOC boundary so RAM is untrusted. There will be a lot of money involved for initial development and prototyping of even the first, open chip. So, I understand if they’re taking it one step at a time. That’s cool as long as they keep the advertising honest about risks they’re keeping in for compatibility, etc.

    1. 2

      I’m curious - how is disk encryption and the key for it handled? Is it kept on the microcontroller, and does the drive itself do encryption in hardware, or is it simply passed to the CPU?

      If the latter is the case, you can’t be sure of the key not leaking, since on an Intel CPU and any non-trivial operating system, you’re going to have unaudited, poorly understood code running.

      1. 2

        ORWL’s solid state drive, an Intel SSD 540s Series, natively supports full drive encryption. The drive’s cryptographic key is generated and stored inside the secure microcontroller. The secure microcontroller provides this key to the SSD only after verifying the integrity of the system. Upon any tampering, the secure microcontroller instantly erases the encryption key, causing all data on the SSD to be irrevocably lost.

        1. 1

          So can the micro controller pass the key directly to the SSD, or does it need to pass by the CPU?

        2. 2

          I’ve never trusted hardware encryption. How do I know it’s encrypted and not just lying to me? Some cheap drives in the past did exactly that. The encryption “key” was really just a password that it needed to turn on, but pulling the media it could be read in another device. How do I know there’s no recovery key?

          But using both can’t hurt.

        3. 2

          No ethernet? :( Especially with a rackmount option, I’d expect cat5.