Hacker News Reader

Comment by wpowiertowski | Hacker News Reader

Exactly why cryptographic authentication is required. There are fuzzing devices today that present themselves as known VID/PID/HID combinations that have generic drivers in modern OS's and can exploit that.

One of the primary drivers for this is the power delivery - imagine a scenario where you have authentic power brick and laptop and buy a counterfeit USB-PD cable, power brick sends 100W over it and it results in the cable melting since it was really a $5 knock-off and you end up with a fried USB-C port in your laptop and possibly a fire. I'm sure most people would wish that the power-brick/laptop checked that cable is genuine and build to handle the power.

View on HN

That seems like a very weak failsafe likely to be easily cracked and those bad actors only slowed down a bit - if history is any guide.

Why not implement something like detecting voltage drop between charger and device? Short circuit detection, etc. You can do a lot if you can have both sides communicate with each other, and at that point it matters a whole lot less if your cable lies to you plus you catch a lot of other failure conditions.

There are more use cases where being able to prove cryptographically the identity of the device is very useful from security point of view, PD is simply one of them.

Apparently, BC 1.2 spec verbiage suggests this is already a hard requirement:

The OTG device is required to limit the current it draws from the ACA such that VBUS_OTG remains above Vaca_opr min.

> One of the primary drivers for this is the power delivery - imagine a scenario...

Not a USB engineer, but a quick peek at the BC 1.2 spec suggests the ball would have to be dropped on at least two additional fronts for the suggested failure mode to occur:

1.) The Charging Port device vendor for failing to implement any of the allowed shutdown measures suggested in BC1.2 §4.1.4; and

2.) the Downstream Port device vendor for failing to constrain current draw based on sensed Vaca_opr min = 4.1V (Table V) per ibid. §§6.2.2 and 6.3.1.

I can see how the knock-off cable would be toast, and depending on insulation rating, may potentially catch fire, but struggle to see how either the CP or DP USB-C ports would fry (considering they're both designed for a target power).

USB-PD only raises the limit from 3 amps to 5. It doesn't increase the risk of fire very much at all, even in a counterfeit cable.

Reply on news.ycombinator.com