@reggie14:
@Harvy66:
The most concerning exploit I can think of is the RNG. Almost any changes to AES-NI will cause the system to stop working and will be easily detectable as storage and network instantly breaks. But changes to RNG does not cause catastrophic failure.
Agreed. To make matters worse, poor RNGs are extremely difficult to detect. And in crypto protocols there are lots of opportunities for the attacker reconstruct the state of your RNG if it has a major weakness.
@Harvy66:
Most any back door related to AES-NI will probably require physical access at some point. AES-NI could save the last N keys in non-volatile on-chip storage or at a certain memory location in dram. Storing unexpected data in dram could very likely result in data corruption unless the location was reserved, but the CPU does not reserve memory, it would have to be in concert with another device that is also back-doored.
Maybe I'm not following you, but AES-NI doesn't do what you think it does. As I said in my previous post, AES-NI is just an accelerator. If you want to steal a key, you certainly don't need physical access. The keys are just sitting in memory, so you just need to memory-scrape it (or, in some cases, read it from disk).
Even if someone wanted to put a backdoor in AES-NI, I'm not even sure what they'd do that wouldn't be better accomplished with some other form of malware. (And those other methods would work perfectly fine against any software crypto library.)
@Harvy66:
Any hardware based remote backdoor would require several devices to work together to accomplish this feat. Doing this transparently in a way that doesn't cause an OS to crash would be quite hard, since not all OSs work the same and they change over time.
Well, that depends on what you mean by a hardware-based backdoor. Purely hardware? Sure, that looks needlessly complicated. But if that includes tampering with low-level firmware, either in the BIOS or in the firmware in any of the numerous devices in your computer with direct memory access, then that doesn't look that hard. It seems like an awful lot of work to for a highly targeted attack, though.
For both the AES-NI and "hardware" backdoors, I was going after is it would be hard to create remote backdoor that was integrated into the hardware and not software. Creating any old remote backdoor wouldn't be hard, but creating an undetectable backdoor that does not crash the system would be quite difficult if it was built directly into the CPU or network silicon.
I assume the easiest place would be into the drivers, assuming they're binary blobs.
