OHSNAP: Difference between revisions

From Noisebridge
Jump to navigation Jump to search
No edit summary
(Initial project info)
Line 1: Line 1:
<span style="color:#f00; font-size:4em;">sos</span>
<h1>Open Hardware for Secure Networks And Privacy (OHSNAP)</h1>
 
This is the project page for OHSNAP, an open-source platform for building secure networks with a known root of trust.
 
<h2>Motivation</h2>
<p>Virtually all commercially-available networking equipment is proprietary and closed-source and cannot be independently verified to be free of malware. There have been documented cases of attackers – [https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies sometimes entire nation-states] – physically modifying networking equipment and networkable devices in order to exfiltrate data and/or command & control otherwise-trusted systems. This leaves the average individual with little choice but to hope that their home network consists of and is secured by devices which do not phone home or contain other backdoors. Such a situation breaks the guarantee that the user's data and devices remain their sovereign property and instead places control into the hands of manufacturers and governments.</p>
 
<p>The goal of this project is to produce a completely open design and implementation for a network router with a verifiable root of trust. By making the hardware design, manufacturing process, and firmware and software stacks fully verifiable, it allows users to inspect the entire end-to-end flow of their data and to directly control some or all of the fabrication of the device in order to establish positive provenance.</p>
 
<h2>Device Summary</h2>
The OHSNAP router will be a single-board computer running an open source firmware and OS. It will expose at least two Ethernet ports.
 
<h2>Design Goals</h2>
* No closed-source firmware or software allowed anywhere in the stack
* Implementation must be independently reproducible by third parties
* Factory-made PCBs must be physically produced in the USA
* Components should be as supplier-diversified as possible
 
<h2>Possible Design Choices</h2>
* CPU
** ARM/ARM64 SoC
** RISC-V SoC
** FPGA
** Specifically no Intel/compatible architectures due to poor security record
* OS / Application Code
** OpenBSD
** Qubes
** Plan9
** Custom FPGA code
*Trusted manufacturers
** [https://www.sfcircuits.com San Francisco Circuits]?
 
<h2>Tentative Project Stages</h2>
* PoC: SW stack on Common Networks
* Proto 1 build: Low-speed (10/100 Mbps) DIY version
* Full build: 1 Gbps
 
<h2>Meetings</h2>
We are currently (as of March 2021) meeting every Saturday at 14:00 PT (GMT-8) on the [https://meet.jit.si/noisebridge Noisebridge Jitsi video platform].
 
<h2>Open Questions</h2>
* CPU
* OS
* How to offer root-of-trust guarantees to non-DIY customers

Revision as of 14:24, 6 March 2021

Open Hardware for Secure Networks And Privacy (OHSNAP)

This is the project page for OHSNAP, an open-source platform for building secure networks with a known root of trust.

Motivation

Virtually all commercially-available networking equipment is proprietary and closed-source and cannot be independently verified to be free of malware. There have been documented cases of attackers – sometimes entire nation-states – physically modifying networking equipment and networkable devices in order to exfiltrate data and/or command & control otherwise-trusted systems. This leaves the average individual with little choice but to hope that their home network consists of and is secured by devices which do not phone home or contain other backdoors. Such a situation breaks the guarantee that the user's data and devices remain their sovereign property and instead places control into the hands of manufacturers and governments.

The goal of this project is to produce a completely open design and implementation for a network router with a verifiable root of trust. By making the hardware design, manufacturing process, and firmware and software stacks fully verifiable, it allows users to inspect the entire end-to-end flow of their data and to directly control some or all of the fabrication of the device in order to establish positive provenance.

Device Summary

The OHSNAP router will be a single-board computer running an open source firmware and OS. It will expose at least two Ethernet ports.

Design Goals

  • No closed-source firmware or software allowed anywhere in the stack
  • Implementation must be independently reproducible by third parties
  • Factory-made PCBs must be physically produced in the USA
  • Components should be as supplier-diversified as possible

Possible Design Choices

  • CPU
    • ARM/ARM64 SoC
    • RISC-V SoC
    • FPGA
    • Specifically no Intel/compatible architectures due to poor security record
  • OS / Application Code
    • OpenBSD
    • Qubes
    • Plan9
    • Custom FPGA code
  • Trusted manufacturers

Tentative Project Stages

  • PoC: SW stack on Common Networks
  • Proto 1 build: Low-speed (10/100 Mbps) DIY version
  • Full build: 1 Gbps

Meetings

We are currently (as of March 2021) meeting every Saturday at 14:00 PT (GMT-8) on the Noisebridge Jitsi video platform.

Open Questions

  • CPU
  • OS
  • How to offer root-of-trust guarantees to non-DIY customers
Retrieved from "https://www.noisebridge.net/index.php?title=OHSNAP&oldid=72810"