Post #4201642

2026-07-29 14:26 UTC

@mario@don.tbully.me @david_chisnall@infosec.exchange In certified software development--the ones I was involved with and read about anyway--this is done by a person who signs off that the implementation follows the spec correctly. There's a bunch of this sort of thing that happens before any silicon is made. Takes a long time and is thus very expensive. Described situation was a demo during research phase sounds like. I hope they'd have found this before it made to production but yeah, no guarantees.

Replies (1)

@david_chisnall@infosec.exchange 2026-07-29 14:34

@crazyeddie@mastodon.social @mario@don.tbully.me In certified software development--the ones I was involved with and read about anyway--this is done by a person who signs off that the implementation follows the spec correctly. No it isn't. At no point in certified software development will anyone sign of on (for example) the C compiler's output being a 100% faithful representation of the C abstract machine. At least, not in any situation where liability may lead back to them, because it is never true (well, it's technically true for CompCERT, though with the all-bets-are-off-if-your-source-code-has-any-undefined-behaviour get-out-of-jail-free card). Described situation was a demo during research phase sounds like. I hope they'd have found this before it made to production but yeah, no guarantees. No, the point of the demo was that you would not find this. It was a tweak that was possible to make during back-end layout or to the GDSII after you've sent it to the fab, so a completely plausible supply-chain attack on a hardware security mechanism. This kind of attack is easier on hardware than software, because you can at least run a compiled program on a simulator.

Open ##4201641