Hacker News Reader

Comment by josephcsible | Hacker News Reader

> Note well: In the end-user version (not TKey Unlocked) the FPGA configuration is locked down. This means you cannot change the FPGA bitstream or read out the bitstream (or the Unique Device Secret, UDS) from the configuration memory, even if you break the case and insert it into a programmer board.

That seems like it's only useful for "security" against the owner, rather than for any legitimate form of security.

View on HN

That's the whole point of a TKey as a security device: the secret available to an application depends on both the device it's running on and the application, and can't be extracted, so you can do things like "sign a blob only if it follows these rules" and enforce it in hardware. If the device wasn't locked, you could just... change the rules.

How is that not a legitimate form of security?

If it's my device, then I should be able to change the rules.

You're more than welcome to change the rules. Please read my other comments in this thread, and you'll hopefully find answers to your concerns. The TKey Unlocked gives you all the control you're asking for.

If you can change the rules then someone else can also change the rules.

And any ability to change the rules will greatly increase the surface area of attack.

Buy the unlocked version, program it and lock it down yourself.

How so?

Consider a DRM system that does challenge/response against said secret so that only one computer at a time can use something. As the owner of this device, if I want to clone it, I should be able to.

You can buy an unlocked version and clone it, no?

But then the device could be used by 2 computers at once defeating the security. Another use case would be as a second factor of authentication. Making it impossible to clone is essential for a "something you own" factor.

Reply on news.ycombinator.com