IBM On Trusted Computing, Linux

An anonymous reader writes "A number of IBM's computers have been available with an "embedded security subsystem (ESS)" for some time now. This site lists three research papers regarding the new TCPA (Trusted Computing Platform Initiative) security chip developed by IBM, including the full GPL-ed source code to a Linux driver for this chip. In particular, the 'Why TCPA?' paper claims that IBM's TCPA chip is in fact of extremely limited use for DRM, as it contains no tamper resistance; the chip is designed to fend off software attacks, not physical attacks. An interesting take from a company with very solid products."

Re:DRM == no sale.

[ciaran_o_riordan]

Unfortunately, It's not that simple.

There are two possibilities:

M$ software will only run on Trusted Computers.
RIAA music will only play on Trusted Computers.
MPAA(?) movies will only play on Trusted Computers.
M$ & Friends will pressure other software companies to require Trusted Computers, under the name of Security or Reliability or Legal-clarity.

Option two is that non-Trusted computers could be made illegal, there is a draft of a proposal to make this law in USA. Will it happen? The RIAA, M$, and MPAA will claim it's necessary to prevent the growing "piracy" trend.

If you do have the option of buying a general computer, you may find it's not much use. And if you put up with that, don't expect Joe Public to stand with you in solidarity, he'll be too busy bopping away to his new "enhanced" Hooty and the Blowfish CD.

Ciaran O'Riordan

Re:DRM == no sale.

[Loosewire]

i HATE what you just said...
beacuse i know its true
how many people do we all know who rushed to get windows media player 9. True example 1 "But tim - it gives them the right to delete all your Mp3's"
"Yeah but they wouldnt do that would they - and anyway it has new flashy effects".
True example 2 "But sam it is full of DRM and adds DRM to all your ripped tracks" -
"Yeah but you can switch it off - look there's an option"
"And if you beleive that then bill gates is my drinking buddy"

Seems reasonable...

[curious.corn]

... let's just, for a moment, cast aside paranoid suspicion (and I'm a paranoid & suspicious chap!). IFF these papers are correct TCPA is an encrypted storage location with some extra logic. In this location the user can store ~/.ssh/*.key and make shure the application interacting with the logic isn't sniffing the un-encrypted stream to some remote location. This NEEDS to be embedded in the BIOS to prevent kernel backdooring and simply embeds chain of trust throughout the hardware. I'd like to see this chip bussed to a smartcard to authenticate private root keys to a hashed ssh-agent binary (whether roaming on different PCs or on my own WS...)
I'm also shure that MediaPlayer 10 will be DRMd to the marrow but take note that in the past ridiculously encumbered online music services went titsup in no time while more reasonable services (Apple) seem to strke a balance.
In the past ID tracking such as the PentiumIII ID were dealt with properly so I don't think abuses would be tolerated. People always enjoys the empowering thought of having the option to take a free ride and imposing a "police" computer would vastly outrage the consumer base.
So long as the control on the hadware keys is left to the users I agree with this particular spin from IBM; it's just a secure smartcard system.
It still CAN be extended to require encryption and trust all the way to the DVI interface but that I think would require a heck of a business infrastructure to implement, maintain and persuasion effort.
And given IBM's perspective there's no interest in the user base to proceed in further HW lockdown... all WE would do is to sign on OUR terms a kernel build and that's it; once that's in place, the chip will process OUR keys in OUR best interest... and if some pigopolist wants force something down our throat their business model will fail (as it has repeatedly done).
I'd go for it, just for the sake of my ssh/gpg keyring, and in the future credit card numbers... do you trust an ecommerce site asking to handle it for you?)

Re:Absolutely Terrific Articles

[OeLeWaPpErKe]

Which concerns would that be ?

-> not being able to see what an application is doing
-> not being able to access an application's datafiles
-> not being able to see what information is sent out over the internet

It doesn't eliminate any of these of course.