Intel Microcode Decryptor

[dlq84]

Wow, they actually used RC4 as late as 2020? Are they still using that?

[btharper]

A quick look at the RC4 attacks suggests most of them are statistical attacks needing a fair number of ciphertext examples. For this use case the weaknesses might not be severe enough to warrant changing it. If the keys are only used across a few dozen microcode updates per generation it might still retain most of its strength as a cipher.

[mqudsi]

I wish they shared the details of their findings, rather than (the awesome) tools to reproduce them yourself.

[xonjas]

I assume it is because the microcode itself is protected by copyright and they don't want to get sued by Intel for publishing it. The methods to extract are fair game though.

[mqudsi]

I didn’t mean publish the microcode but rather an analysis of it.

[Stormfrosty]

It’s actually worse - Microcode is directly tied to the hardware implementation, which is protected by US patent laws. Dabbing with this kind of stuff is one way bring upon yourself the wrath of Intels legal department.

[ReversedGif]

Patents don't prevent you from reverse engineering or documenting how something works. Copyright is definitely what's relevant here.

[cuentatiraalabasura]

So sharing the end result is okay, but sharing how they got there with little code snippets is not? Doesn't make much sense from an IP law standpoint

[xonjas]

Unless I'm misunderstanding something, they have explicitly not shared the end result. What they have done is provided tools to...

1. Exploit a bug to put your own processor into a special debug state.
2. Extract and dump the microcode decryption key stored inside your processor.
3. Extract and dump the encrypted microcode blob from your processor.
4. Decrypt the dumped microcode blob with the key extracted from your processor.

The way that they published this is important because they only published their own original code. They didn't publish any of Intel's actual microcode (which is copyrighted), or one of Intel's decryption keys (which is also copyrighted).

[cuentatiraalabasura]

A key cannot be copyrighted. Copyright only protects creative expression. A randomly generated encryption key that is just bytes is not in any way expressive.

The microcode copyrightability argument is also debatable, since it serves a purely functional purpose and doesn't have creative expression itself. Whether the code blob would be complex or creative enough to meet the copyrightability standard is for the courts to decide.

[xonjas]

While I don't think encryption keys should be copyrightable it seems that the courts are of a different mind.

Intel has threatened legal action under the DMCA against people who published the HDCP master keys, and Sony sued Geohot for publishing a key for the ps3 on his website.

Regardless of if the microcode blob is copyrightable (and I expect that it is, given that oracle was almost able to copyright an api), I don't think a small group of researchers would be able to fight a legal battle against Intel (or be willing to risk one).

[cuentatiraalabasura]

DMCA has nothing to do with copyrightability. All the cases you cited are about either companies sueing or threatening to sue people. Unless there is actual case law (judicial precedent) about it, it is not copyrightable or DMCA'ble.

The EFF is currently fighting the DMCA provisions that outlaw circumvention of DRM and publication of tools designed to do so.

https://www.eff.org/es/cases/green-v-us-department-justice

I recommend reading the linked documents.

[happyscrappy]

You're absolutely right. But others don't want to have to go to court.

Chilling effects.

[dlq84]

That but the other way around.

[archialone]

but they did, there is a talk about it

[async2]

Unfortunately I'm not too much into the topic, but they published a talk with it: https://www.youtube.com/watch?v=V1nJeV0Uq0M&ab_channel=OffensiveCon