{"id":52523,"date":"2019-11-10T00:00:00","date_gmt":"2019-11-09T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/opensorsnyj-chip-opentitan-zamenit-proprietarnye-korni-doveriya-intel-i-arm"},"modified":"2020-02-18T14:00:16","modified_gmt":"2020-02-18T11:00:16","slug":"opensorsnyj-chip-opentitan-zamenit-proprietarnye-korni-doveriya-intel-i-arm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/opensorsnyj-chip-opentitan-zamenit-proprietarnye-korni-doveriya-intel-i-arm","title":{"rendered":"\u00c7ipi me source t\u00eb hapur OpenTitan do t\u00eb z\u00ebvend\u00ebsoj\u00eb rr\u00ebnj\u00ebt e besimit pronar nga Intel dhe ARM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"\u00c7ipi
\n
\nOrganizata jo fitimprur\u00ebse lowRISC<\/a><\/noindex> me pjes\u00ebmarrjen e Google dhe sponsor\u00ebve t\u00eb tjer\u00eb m\u00eb 5 n\u00ebntor 2019 ka prezantuar<\/a><\/noindex> projekt OpenTitan<\/a><\/noindex>, i cili e quan \u00abprojekti i par\u00eb me kod t\u00eb hapur p\u00ebr krijimin e nj\u00eb arkitekture t\u00eb hapur, cil\u00ebsore p\u00ebr \u00e7ipin me rr\u00ebnj\u00eb besimi (RoT) n\u00eb nivelin harduerik\u00bb.<\/p>\n

OpenTitan me arkitektur\u00ebn RISC-V \u00ebsht\u00eb nj\u00eb \u00e7ip i dedikuar p\u00ebr instalim n\u00eb servera n\u00eb qendrat e t\u00eb dh\u00ebnave dhe n\u00eb \u00e7do pajisje tjet\u00ebr ku k\u00ebrkohet t\u00eb garantosh autenticitetin e ngarkes\u00ebs, t\u00eb mbrosh firmware nga ndryshimet dhe t\u00eb eliminosh mund\u00ebsin\u00eb e rootkit-eve: k\u00ebto jan\u00eb plakat e n\u00ebn\u00ebs, kartat rrjet\u00eb, router\u00ebt, pajisjet IoT, pajisjet mobile dhe t\u00eb tjera.<\/p>\n

Sigurisht, k\u00ebto module jan\u00eb t\u00eb pranishme n\u00eb procesor\u00ebt modern\u00eb. P\u00ebr shembull, moduli harduerik Intel Boot Guard \u00ebsht\u00eb rr\u00ebnja e besimit n\u00eb procesor\u00ebt Intel. Ai verifikon autenticitetin e UEFI BIOS para ngarkes\u00ebs s\u00eb sistemit operativ p\u00ebrmes nj\u00eb zinxhiri besimi. Por pyetja \u00ebsht\u00eb, sa mund t\u00eb besojm\u00eb n\u00eb rr\u00ebnj\u00ebt e besimit pronar t\u00eb marr\u00eb parasysh se nuk kemi garanci p\u00ebr munges\u00ebn e gabimeve n\u00eb dizajn, dhe se nuk \u00ebsht\u00eb e mundur ta verifikojm\u00eb at\u00eb? Shihni artikullin \u00abNgarkesa e besuar e Schr\u00f6dinger-it. Intel Boot Guard\u00bb<\/a><\/noindex> me p\u00ebrshkrimin se \u00absi nj\u00eb gabim i klonuar p\u00ebr vite me radh\u00eb n\u00eb prodhimin e disa furnizuesve lejon nj\u00eb agresor potencial t\u00eb shfryt\u00ebzoj\u00eb k\u00ebt\u00eb teknologji p\u00ebr t\u00eb krijuar nj\u00eb rootkit t\u00eb fsheht\u00eb n\u00eb sistem q\u00eb nuk mund t\u00eb fshihet (as nga programatori)\u00bb.
\n<\/a><\/noindex>
\nK\u00ebrc\u00ebnimi i komprometimit t\u00eb pajisjeve n\u00eb zinxhirin e furnizimit \u00ebsht\u00eb befasues real: duket se \u00e7do elektronik i amator mund t\u00eb vendos\u00eb nj\u00eb d\u00ebgjuese n\u00eb pllak\u00ebn e n\u00ebn\u00ebs s\u00eb serverit<\/a><\/noindex>, duke p\u00ebrdorur pajisje q\u00eb nuk kushtojn\u00eb m\u00eb shum\u00eb se 200 dollar\u00eb. Disa ekspert\u00eb dyshojn\u00eb se \u00aborganizatave me buxhete prej qindra miliona dollar\u00ebsh mund t'u interesonte kjo p\u00ebr shum\u00eb vite\u00bb. Megjith\u00ebse nuk ka prova, teorikisht, kjo \u00ebsht\u00eb e mundur.<\/p>\n

\u00abN\u00ebse nuk mund t\u00eb besoni n\u00eb ngarkuesin harduerik, loja ka mbaruar, \u2014 SETUP.EXE: ekzekutues MS-DOS, NE p\u00ebr MS Windows 3.x<\/a><\/noindex> Gavin Ferris, an\u00ebtar i k\u00ebshillit drejtues t\u00eb lowRISC. \u2014 Nuk ka r\u00ebnd\u00ebsi se \u00e7far\u00eb b\u00ebn sistemi operativ\u2014n\u00ebse n\u00eb momentin e ngarkes\u00ebs s\u00eb sistemit operativ ju jeni komprometuar, at\u00ebher\u00eb gjith\u00e7ka tjet\u00ebr \u00ebsht\u00eb nj\u00eb \u00e7\u00ebshtje teknike. Ju keni r\u00ebn\u00eb.\u00bb<\/p><\/blockquote>\n

\nKjo \u00ebsht\u00eb problemi q\u00eb duhet t\u00eb zgjidh\u00eb platforma e par\u00eb hapur harduerike OpenTitan (repo GitHub<\/a><\/noindex>, dokumentacioni<\/a><\/noindex>, specifikimet harduerike<\/a><\/noindex>). T\u00eb hequrit dor\u00eb nga zgjidhjet pron\u00ebsore do t\u00eb ndryshoj\u00eb<\/p>\n

industrin\u00eb e ngadalt\u00eb dhe t\u00eb mang\u00ebt RoT mendon Google.<\/a><\/noindex>, por pa sukses.<\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb rr\u00ebnja e besimit?<\/h1>\n

\n\u00c7do etap\u00eb e procesit t\u00eb ngarkes\u00ebs s\u00eb sistemit verifikon autenticitetin e etap\u00ebs tjet\u00ebr, duke formuar k\u00ebshtu nj\u00eb zinxhir besimi<\/i>.<\/p>\n

Rr\u00ebnja e besimit (Root of Trust, RoT) \u00ebsht\u00eb nj\u00eb verifikim i hardware-it q\u00eb garanton se burimi i instruktionit t\u00eb par\u00eb ekzekutues n\u00eb zinxhirin e besimit nuk mund t\u00eb ndryshohet. RoT \u00ebsht\u00eb mbrojtja kryesore kund\u00ebr rootkits. Ky \u00ebsht\u00eb nj\u00eb hap ky\u00e7 n\u00eb procesin e ngarkes\u00ebs q\u00eb merr pjes\u00eb n\u00eb nisjen e m\u00ebtejshme t\u00eb sistemit - nga BIOS deri te OS dhe aplikacionet. Ai duhet t\u00eb verifikoj\u00eb autenticitetin e \u00e7do etape t\u00eb m\u00ebtejshme t\u00eb ngarkes\u00ebs. P\u00ebr k\u00ebt\u00eb, n\u00eb \u00e7do etap\u00eb p\u00ebrdoret nj\u00eb grup \u00e7el\u00ebsash me n\u00ebnshkrim digjital. Nj\u00eb nga standardet m\u00eb t\u00eb njohura t\u00eb mbrojtjes s\u00eb hardware-it p\u00ebr \u00e7el\u00ebsa \u00ebsht\u00eb TPM (Trusted Platform Module).<\/p>\n

\"\u00c7ipi
\nKrijimi i rr\u00ebnj\u00ebs s\u00eb besimit. M\u00eb sip\u00ebr \u00ebsht\u00eb nj\u00eb ngarkes\u00eb me pes\u00eb etapa q\u00eb formon nj\u00eb zinxhir besimi dhe fillon me ngarkuesin q\u00eb ndodhet n\u00eb memorie t\u00eb pandryshueshme. N\u00eb \u00e7do etap\u00eb p\u00ebrdoret nj\u00eb \u00e7el\u00ebs publik, i cili verifikon autenticitetin e komponentit tjet\u00ebr q\u00eb ngarkohet. Ilustrimi nga libri i Perry Lee \u2018Arkitektura e internetit t\u00eb gj\u00ebrave\u2019<\/a><\/noindex><\/i><\/p>\n

RoT mund t\u00eb nis\u00eb n\u00eb m\u00ebnyra t\u00eb ndryshme:<\/p>\n