Intel ID Protection Scheme Called Insufficient

Welcome Guest. | Log In| Register | Membership Benefits

January 28, 1999 (10:34 AM EST)

Intel ID Protection Scheme Called Insufficient

By Craig Matsumoto,

At least one critic of Intel's plan to place identification numbers on each of its Pentium III processors said the protection scheme Intel devised for the plan wouldn't have covered up its technical shortcomings.

Cryptography expert Bruce Schneier, president of consulting company Counterpane Systems, in Minneapolis, said while Santa Clara, Calif.-based Intel had worked to mask the ID number during legitimate queries from Web servers, the scheme wouldn't safeguard against abuses of the ID number and would probably have been open to spoofing or hacking. Intel reversed its plans to incorporate an ID number on its upcoming Pentium III chips Monday after outcries from privacy advocates.

"There is no such thing as tamper-resistant software on a general purpose computer," Schneier said. "If your computer can see the instructions, then you can see them, too. Intel does have a technology for tamper-resistant software -- they presented it at an academic workshop last year -- but it is only mediocre.

"The concern is not from the legitimate methods websites will use to query the ID, but from illegitimate methods," he added.

Intel's scheme was to rely on software code that scrambles the ID number uniquely for every website visited. Among Schneier's concerns was the fear that the ID number could have been spoofed, i.e., software could have spit a randomized forgery instead of the real number -- and that the scheme itself was subject to hacking.

While the scheme might be very difficult to crack, Schneier said he was concerned Intel's protections would be hacked, and that the hack would have been distributed all around the Net.

"This system is only as secure as the smartest hacker," he said. "All it takes is for one person to defeat the tamper resistance. There's always someone who manages to unravel the protection. There isn't a copy-protected piece of software that hasn't been stripped of its protections and posted to hacker bulletin boards. This won't be any different."