Hacker News Reader

Comment by userbinator | Hacker News Reader

AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says

This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage.

If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI setup already, correct?

View on HN

The PSP is already quite long in the tooth. I think AMD will switch to ARM's recently announced "SecurCore" soon, just like Qualcomm did for the Snapdragon 845:

https://developer.arm.com/products/processors/cortex-m/sc300...

That "processor" has been out for at least ten years.

It's not related to Secure Boot, no, so there's no requirement for physical access.

I think Intel's ME is much more complex than AMD's PSP. Does anyone know if AMD's PSP has a full network stack and the ability to interact with network hardware independent of the main CPU's OS?

I had read somewhere that AMD PSP does not have Internet access.

It does, DASH is also arguably much less secure than Intel's RMT.

Hmm, I did not know this. Good to know!

Is there a documentation of what its capabilities are? I can't find anything specific about it.

Of the remote management? Only this https://developer.amd.com/tools-for-dmtf-dash/

AMD hasn't really had any hardware for the enterprise for a long time so they are quite behind on many things.

This is their free remote admin tool : https://community.amd.com/community/devgurus/dmtf-dash/blog/...

It can basically do quite a few things, change firmware, boot an image, redirect USB input and likely quite a few of other undocumented things.

With Ryzen Pro launching soon I guess AMD would release a new suite of remote management software.

Thank you.

Yes, AMD's PSP runs a full OS which was made by Trustonic.

Trustonic is about as trustworthy a name as "Safecorp" or something similar. The name itself is just one big red flag.

They are probably the largest TEE* supplier AFIK even bigger than Intel; they are pretty much the Java of the TEE world.

It’s a joint venture between ARM, Gemalto and a few other companies iirc.

*Trusted Execution Environment

Ahhh, okay. Thanks for the clarification!

It must feel weird to create an operating system that runs on a CPU inside a bigger CPU.

Technically if you count virtual machines as CPUs then every piece of Javascript etc. code runs in a CPU inside a CPU :P

TPM's are supposed to be resistant to physical attacks.

With this flaw, someone can just stick a bootable USB stick in your computer to mirror the LUKS/bitlocker disk drive and get access to the keys in the TPM which protect that drive.

For discrete TPMs the specification explicitly says that they are not required to be resistant to physical attacks (probably because that would require specifying what kinds of attacks it is supposed to be resistant to).

Reply on news.ycombinator.com