Schneier on Security

Clive Robinson • April 11, 2023 7:26 PM

@ ALL,

Re : Wiring Harnesses.

Unless you’ve had to design a wiring harness for a complex three dimensional shape, especially one like a Vehicle monocoque. Where it has to go through bulkheads and firewalls, as well as having to survive a full crumple zone T-Bone / side swipe or similar accident and still give full control to the essential systems such as brakes and similar… You might under estimate the task and cost/risk involved.

Multiple wires “laced together” add a stiffness thus flex failure increase, and a single fault makes the entire very expensive harness worthless. It’s one of the reasons the way more complex “multidrop networks” on a single cable / channel were even considered. Not because they increased potential features, or decreased weight and bulk, but because they significantly decreased the manufacturing risk and cost.

Further, if post manufacture upgrades are required, all that is needed is an “Insulation Displacment Connector”(IDC) be “punched down” onto the existing cables thus significantly easing the task and reducing the risk. Thus “three wire” and “four wire” multidrop networking especially “multi master” systems are very desirable for such tasks.

Without going into the electrical interfacing specifics, such systems can be effectively AC coupled thus galvanically issolated, such that “hard fail” faults do not lock up the network nor do “earth loop” faults arise. In fact bi-phase systems can have a secondary “phantom channel” that can be used for some types of “master / all node signalling”.

Clive Robinson • April 12, 2023 5:43 PM

@ WB,

Since you adressed,

“Blah Blah Blah. People have known this day was coming since at least 2007.”

At me…

It was longer actually, way way longer, you will note I said “last century” above, and compared it to an attack some security folks were protecting against in the 1960’s (by the likes of “physical measures” such as pressurized conduiting with alarms driven by pressure sensors and similar).

Back when these IO buses came into existance the 8bit CPU as a control engine (See PIC controlers[1]) were the way to do “system IO” in “Control Systems” (and in many cases still are with newer parts in the PIC line up).

Whilst they accomplished many things, such microcontroler chips could not even do “DES” and earlier crypto, they just did not have the resources.

And this has always been the issue,

“Security needs high end resource computing just to do standard encryption algorithms.”

Even microcontrolers with “security built in” such as for automotive industry door locks were often based on “rolling codes” (effectively “poorman’s stream ciphers” built on “Linear Feedback Shift Registers”(LFSR) designs).

Likewise in modern 32bit microcontrolers based,around MIPS CPU core “silicon macros” AES generally requires “silicon real estate” that is unavailable in low power microcontrolers used in control systems. Thus Public Key and similar is effectively beyond most microcontroller based designs even now so “physical security” measures are required still…

[1] The “Peripheral Interface Controller”(PIC) was originally developed by the Microelectronics Division of “General Instruments” back in the mid 1970’s. It was little more than a 8bit CPU with 12bit instructions to act as a “sequence controller” to replace large amounts of TTL and similar control circuits. It was the 1970’s that saw the birth of another 4bit “calculator chip” the 4004 from Intel that gave rise to the 8bit 8080 and Z80, with other 8bit chips like the 6502 –which is still in production as a licenced macro– giving birth to the home and business “Personal Computers”. The PIC however never realy made it out of the “IO control” field, and ended up being one of the most used “out of sight” microcontrolers in embedded systems.