Showing posts with label PQC. Show all posts
Showing posts with label PQC. Show all posts

Saturday, March 29, 2025

33 years in the Panopticon, Books, et al

This is the inaugural blog entry of 2025. I used to try to have at least one posting per month, but the last couple of years have demonstrated something of a slowdown.

In lieu of my Anniversary.Next^ postings like https://vzimmer.blogspot.com/2024/02/27-or-anniversarynext12-ai-runtime.html which tracked the latter portion of my Intel journey, I have to find another temporal indicator to inspire a posting.  

To that end, Monday 2/24/25 made 33 years of working full-time post undergrad (2/24/1992). Someone who I admired a lot and retired on the same day from MS contacted me recently to check-in. I told him that I re-entered the workforce and he replied with "RETIREMENT FAIL!" I opined that maybe it's a case of a prisoner that misses his prison cell? Speaking of cells, I now have a named one:


Another quote I recall was that if you are still working in tech in your 50's then you are 'doing it wrong.'  Oops. From Intel "Rule of 75" for retirement to the IRS "Rule of 55" for 401k's, quite a flurry of "Rules of..." these last 6 months.

To move from corporate and government 'rules' into levity, an icebreaker event that occurred a couple of months back was a bit amusing. It entailed a large business conference call where participants were asked to share their favorite reality TV show in the Teams poll. The host berated the crowd for the many mentions of Severance https://en.wikipedia.org/wiki/Severance_(TV_series) in the result stream as demonstrating a misunderstanding of the question. I personally don't believe the respondents were so confused after all. "Perks" anyone https://www.teamblind.com/post/Microsoft-Perks-7yf2EYnJ https://severance.wiki/perks?

BTW I've only seem fragments of Severance when passing by my younger daughter watching it so I may have have drawn some false equivalences from my scant data.  I'm just saying.....

Speaking of questions, the in-person q/a with sci-fi author https://en.wikipedia.org/wiki/Cory_Doctorow were quite interesting at a local book store.


The q/a overlapped many of the points he made in https://www.democracynow.org/2025/2/26/cory_doctorow.




I soldiered through the long line to get an autograph at the end of the evening


and mentioned that I worked on UEFI. I wanted to stimulate a conversation given some of the points he made online in venues like https://doctorow.medium.com/your-computer-is-tormented-by-a-wicked-god-e90205ed80d7 and https://pluralistic.net/2024/01/18/descartes-delenda-est/, viz., 


After I told Corey what I worked on, he asked where. After the latter response I could see that he tensed tensed up.  I eased situation by saying his voice was important, especially with the passing of folks like Ross Anderson https://vzimmer.blogspot.com/2024/03/a-legend-passes.html and his positions on the topic https://www.lightbluetouchpaper.org/2011/09/20/trusted-computing-2-0/.  






Doctorow had a lot of good quotes in his talk, such as "you cannot reason someone out of a position into which they haven't first reasoned themselves into." I should dig into my notes and share out a few other of the fragments from that evening.

From 3rd Place books back to one of my favorite locations at Microsoft, the Microsoft library


And visiting with some former Intel colleagues now working at AMD and non-Redmond MS site, respectively.




Again, sometimes on these cross-campus treks I stop at the Microsoft Library in building 92. It's interesting to see which of the firmware books have been checked out at various times, viz., 



Sticking to the topics of books, at my local building, co-worker Jose visited again after having 


our Thanksgiving time https://vzimmer.blogspot.com/2024/11/turbulent-weather-books-and-new-jobs.html posting to get his trio of firmware-related Apress https://link.springer.com/book/10.1007/978-1-4842-6106-4 https://link.springer.com/book/10.1007/978-1-4842-7974-8 https://link.springer.com/book/10.1007/978-1-4842-7939-7 books signed.

The security book I'm holding has a section on Rust https://link.springer.com/book/10.1007/978-1-4842-6106-4



as does https://link.springer.com/book/10.1007/978-1-4842-7974-8



As such, it was nice to see Rust and firmware mentioned in https://www.youtube.com/watch?v=1VgptLwP588


Good stuff.

On a sad parting note on the topic of technical books, Stuart Douglas


passed away recently.

After a career at Intel working on things like RMX, he pivoted into technical publishing. He was my contact at Intel Press for a series of publications, including the 2006 first edition of Beyond BIOS https://www.amazon.com/Beyond-BIOS-Implementing-Extensible-Interface/dp/0974364908
the UEFI Shell https://www.amazon.com/gp/product/1934053147/

the UEFI edition of the Intel Technology Journal (ITJ) 

the SIMICS ITJ edition that included the Driver Synthesis paper 

and the embedded IOT book https://link.springer.com/book/10.1007/978-1-4842-0070-4

My participation in the 2013 ITJ was close to the end of Intel Press. The reason that the Apress book mentions Stuart and has so many Intel authors circa 2015 is that Intel Press closed down in 2014 os so. I chronicled some of the arc of Intel Press in https://vzimmer.blogspot.com/2021/01/books-and-computers.html.  This closure was part of the austerity (SET or ACT or...?) under BK AFAIK. My final communication with Stuart was about the Secure Firmware Book https://link.springer.com/book/10.1007/978-1-4842-6106-4 book where he had introduced Jiewen and I to the Apress folks and helped with the proposal for that 2020 text



It looks like Stuart's Linkedin page is still active, though

And speaking of LI, I sometimes find 'interesting' bread crumbs of visitors to my site. 





A recent list of visitors looks mostly usual other than the USG viewer at the bottom

At least it was 'dept of state' https://en.wikipedia.org/wiki/United_States_Department_of_State and not 'dept of justice' or some such :)


Speaking of web metrics, another milestone involves the PQC SPDM paper https://www.mdpi.com/2410-387X/6/4/48 reaching 10k views as of 3/25/2025.

And then there was 30

for my sporadic IEEE membership since my Cornell undergrad days.

Nice round #'s to close this inaugural 2025 blog entry.

fin



Thursday, November 30, 2023

i/o, globalization, pqc, ai, oh yes

I talked a bit about the RAID work at Compaq, or the SMART2-SL 'Dazzler' board in my last post http://vzimmer.blogspot.com/2023/10/october-firmware-events.html. Another interesting thing that landed while at CPQ was I2O https://en.wikipedia.org/wiki/I2O, or 'Intelligent Input / Output.' The idea was to bring intelligent offload engines to open platforms. The Wikipedia post has some views of its history. My view was that version 1.0 was challenging in that it asked the host to do the data movement, not the I/O card. If you are offloading the last thing you want to do is encumber the host with 'more work.' We built an adapter card on top of our CPQ RAID controller to provide the I2O hardware interface and then we mapped the commands into our internal command set. Version 2.0 described having the data mover in the I/O device, which made more sense. 

This reminds me of the cycle of technology. Patterns like offloading I/O from the host CPU, from IBM channel processors of old, I2O gestures, Myrinet smart NICs (woohoo - safe code, Modula3, too) https://dl.acm.org/doi/pdf/10.1145/319195.319197, Nitro, DPUs, IPUs,....traversing the 1950's to today.

The post also mentions UDI.  Interesting stuff. Reminds me of the complaint about UEFI that it didn't solve the 2 problems of the BIOS ecosystem - suppliers and having to write a driver 2x - once for pre-OS and again for the OS. UEFI attempted to solve a class of this issue w/ UNDI, both the 'hardware UNDI' and the software UNDI. The former would be architectural hardware like VGA to allow for runtime access. In practice the latter was solved with GOP and the framebuffer at runtime. For I/O this was a mile too far.

Speaking of blogs, I haven't quite figured out the substack phenomena. Is this the new 'blogger'? I created account https://panopticon404.substack.com/ but haven't posted.  Google 'the panopticon' and guess my motivation for that name. 



I really like blogger.  going on 14 years using the service.  I had fear initially that when google bought it they'd kill it, but I suspect it's a low-impact enough service like other freebies, including my homepage https://sites.google.com/site/vincentzimmer/ that it's not worth closing and generating the associated ill will?

Unlike blogging at Intel where 1st party sites like 'uefidk.com' (mentioned 9 times in https://link.springer.com/book/10.1007/978-1-4842-0070-4, sigh) that went away w/o redirecting the content to somewhere like firmware.intel.com, I realize how ephemeral these sites can be.

Speaking of substack, https://www.noahpinion.blog/p/the-next-phase-of-globalization-is had an interesting post around globalization. I still recall how Richard Wirt set up PRC firmware team in '01.  Similar teams in Russia.  He was 'globalization before globalization was cool' IMHO.

I enjoy collaborating w/ colleagues across the globe. The 2020 book w Jiewen Yao in Shanghai, PRC. The SPDM paper https://www.mdpi.com/2410-387X/6/4/48 w/ Jiewen and Krystian in Gdansk, Poland. Two 2022 books w/ Subrata in Bangalore, India. I think I touched on this point of book author geo's in http://vzimmer.blogspot.com/2022/10/a-tale-of-two-books.html. 

The SDPM talked about post-quantum cryptography (PQC). This is a space getting attention, and pages 23+ of https://uefi.org/sites/default/files/resources/USF_Security_Webinar_Final.pdf talk about work for host firmware, including a proposal for accommodating PQC in UEFI https://bugzilla.tianocore.org/show_bug.cgi?id=4087.  

Describes the proposed mapping.

Provides the deadlines. With some of the challenges in evolving the UEFI CA and Secure boot ecosystem https://uefi.org/sites/default/files/resources/Evolving%20the%20Secure%20Boot%20Ecosystem_Flick%20and%20Sutherland.pdf this will be an interesting journey.

The wave keeps flowing

I argue that the workday is like barbells.  There are a spate of meetings from 6am to 10am PST for Europe, Israel and India.  Then the PRC workday starts at 5pm PST and pick up India workday at 8pm, netting out to a typical day of 6am to 11pm.  

Luckily Saturday no one has a workday afaik.  I recall this theme as a broken record with me given my anecdote on http://vzimmer.blogspot.com/2021/01/books-and-computers.html about the currency trader.

Occasionally I sneak out to Seattle in the PM to catch events. Recently https://tech.cornell.edu/people/greg-morrisett/  was in town to meet with alumni. It was nice to meet the creator of Cyclone & typed assembly. I had to share my tales of woe trying to use Cyclone https://cyclone.thelanguage.org/ in the early days and was happy to see a mainstream memory-safe systems language like Rust appearing on the scene. This tech inspired some interesting designs on my side, including the below that will expire in 2 weeks, viz.,




Greg mentioned the challenges of industry to hire folks for high assurance software work. 

Maybe that problem of moving folks to Rust will be ameliorated by the 'assistant gap' mentioned by IOActive? I dropped in the IOActive event tonight in Bell Town and their CTO talked about "the SDLC process and AI." He mentioned how chess assistants after the Deep Blue event with Karsparov in 1995 had a 10 year run until event an assisted human couldn't beat a machine. He then showed the exponential growth in code writing assistants commencing in 2020 and pondered how much shorter the 'era of assistants' will run for code writers until the day the machine does all of the work and the prevailing 'programming language' becomes English.

As a quite side-bar on AI, I worked my way through https://www.amazon.com/gp/product/0137470355/ over the thanksgiving holiday. I liked the mixture of math and programming, along with the historical arc it described. I was amused by the point that the early deep learning efforts felt compelled to have a mathematical foundation for their work to 'justify it' whereas with the latest efforts like generative AI people haven't expected such pedagogy if things 'work well.' The book reinforced my assertion that learning the basics of math will serve you well as the trends of tech churn. For example, having mastered the basics of linear algebra, eigenvalues, etc as an undergrad decades ago are still relevant in this deep learning work today. The same holds for statistical signal processing, information theory, and signal detection from the electrical engineering corpus. But the deep learning domain is so expansive and fuses art like big data, software systems, computer architecture (e.g., array processing redux). I can now better appreciate the point Mark R. made in 38:4 https://www.youtube.com/watch?v=Wx1WBLdUwtg about using his summer sabbatical to get more experience with these deep learning frameworks.

I'm no "Mark R.", of course, but perhaps an option to use my backlog?


BTW - the joke used to be that AI was 'the technology that didn't work.' Meaning once an AI technique proved feasible in the corpus they were ejected and relabeled as some domain of engineering. The script seems flipped today in that being labeled 'AI' is a compelling argument for the tech, irrespective of its efficacy.

So take the barbell day mentioned above and mix in  return to office (RTO). It's nice to see an office again. Sometimes I tell folks that I like the office since it's sort of like Pavlov's dog, but instead of 'ringing a bell' to get a response the stimulus is 'sitting in a cubicle.' An interesting observation, though, about others around me post-COVID. I'm not sure if folks are used to WFH and speaking into their USB speakers, or if we are just getting older and losing our hearing, but folks nearby in the office are pretty loud on the phone.  Since the bulk of the day is still on the phone for a global team, I'm getting complaints from the folks on the call that my neighbor conversations/background noise is too loud.  

From the file of neighbors in the past, Dupont circa late 90's, I sometimes recall Ken Wiletzki. He retired a week before his 40th bday so could say 'retired in my 30's'. In the following year he'd send pictures of himself mountain biking, etc, but after that he went dark. I guess retirement joy consumed any time of 'sharing retirement' with the folks still in office-land. One interesting tale from Ken is that he claimed that he tried to hire Linus Torvalds, then a computer science student in Finland, to work on his validation team at Intel.  Ken created 'kaos' - Ken's Arbitrary OS - for validation of the hardware devices. Ken claimed that Intel couldn't since Linus was overseas and didn't yet have his masters degree. I'm not so sure of this fact since there is no mention in the 'Just for fun' https://www.amazon.com/Just-Fun-Story-Accidental-Revolutionary/dp/0066620732 bio of Linus. Someone who is mentioned in that book is another Intel colleague H. Peter Anvin who in fact merits 2 appearances - once for getting Linus his first PC, and the second for bringing Linus to the US to work for Transmeta.

Other interesting meetings in the local region include the Rust meetup at the connector building on the MS campus. Nice finally meeting Ben Stoltz of Oxide in person after talking w/ him many a time during his Google Cloud security tenure. I liked when Ben asked one presenter 'what does that mean for a pertrified (or did he say 'prehistoric'?) C programmer.' My people. 


Wednesday, August 17, 2022

PQC

I haven't blogged in 3 months, so I thought I would create a short post this evening.

One thing that I've noticed in my behavior lately is that I often say "I understand" versus "I agree." Latter implies I have a vote on the topic. I also find myself demonstrating the behavior that "as you age in industry you become more 'historian' than 'expert'". But the plurality of ambitious folks who believe they are 'expert' often fight when you lean too much into history mode. Their behavior reminds me of the quote 'the person may be wrong but is never in doubt.' 

As I get older I am tacking the opposite direction of confidence in all matter.  I find I doubt things more as I apprehend the huge swaths of knowledge I haven't penetrated on this life journey. I don't like Bukowski's "The problem with the world is that the intelligent people are full of doubts, while the stupid ones are full of confidence." quote in this area, though. It implies the issue involved is one of intelligence. I rather prefer to chalk it up to intellectual humility. 

Hopefully I demonstrate some of that behavior in my interactions. If I were up to the challenge of watching myself on video, I'd audit my revisit to Chips & Salsa https://www.youtube.com/watch?v=wqcUWAEHcVg. I recall blogging about that venue a while back http://vzimmer.blogspot.com/2021/11/books-old-age.html, too.

Regarding a topic area that reminds me of the of breadth of knowledge and progress, I'd like to recall the post quantum cryptography (PQC) talk https://uefi.org/sites/default/files/resources/Post%20Quantum%20Webinar.pdf. Readiness for PQC includes recent UEFI specification code-first readiness https://bugzilla.tianocore.org/show_bug.cgi?id=3413 and https://bugzilla.tianocore.org/show_bug.cgi?id=3725. A 2022 augmentation of a feature first conceived 15 years ago https://www.semanticscholar.org/paper/Platform-Trust-Beyond-BIOS-Using-the-Unified-Zimmer/0bd3bdeb6dcadf088137e13c00adc7e4390fa0de


I was enthralled with the various RT's.  Roots of Trust for Storage & Reporting (RTS/RTR) in the TPM, Root of trust for measurement (RTM) and Root of trust for enforcement/verification (RTE/V) for the platform firmware. This predated the RTU and RTD from https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-193.pdf years later.

Beyond UEFI there are other industry standards that require PQC accommodations. These include protocols like SPDM https://www.dmtf.org/sites/default/files/standards/documents/DSP0274_1.0.1.pdf. The cryptography eprint https://eprint.iacr.org/2022/1049 posted today describes some of this work. This is definitely an 'application' of cryptography versus cryptographic research. The latter is especially challenging, as demonstrated by recent findings like https://thequantuminsider.com/2022/08/05/nist-approved-post-quantum-safe-algorithm-cracked-in-an-hour-on-a-pc/. I am a fan of this type of analysis. I did feel a little bit like we were guilty of Pike's 2000 diatribe "Mostly, though, it's just a lot of measurement" http://doc.cat-v.org/bell_labs/utah2000/utah2000.html. 

This news story reminded me of former co-worker Ernie Brickell's knapsack paper https://link.springer.com/content/pdf/10.1007/3-540-39568-7_27.pdf. Ironically Merkle https://en.wikipedia.org/wiki/Ralph_Merkle is related to a present co-worker and I was able to grab an autograph for my book on Merkle's original knapsack work












Ernie was a rare combination of PhD and leader. I still recall Ernie trying to recruit me to join his team a decade ago. Ernie did fascinating work on zero-knowledge proofs, including co-inventing Direct Anonymous Attestation (DAA) https://eprint.iacr.org/2010/067.pdf that was eventually included in the TPM 2.0 specification. Definitely a different eprint than item mentioned at top of this blog https://eprint.iacr.org/2022/1049.pdf. Ernie also introduced me to David Chaum https://en.wikipedia.org/wiki/David_Chaum of zero-knowledge proof fame, too, at an Intel event. 

One cautionary tale I learned from Ernie was avoiding going all in on a given position. The combination of drive, technical depth, and passion for a topic can create a lot of p=mv momentum https://www.calculatorsoup.com/calculators/physics/momentum.php when slamming into the walls that one often finds in bigCo.  

Speaking of years ago, I am happy to see progress https://github.com/UniversalScalableFirmware/fspsdk/tree/qemu_fsp_at_reset toward the vision of 



from page 143 of https://link.springer.com/book/10.1007/978-1-4842-0070-4. This is yet another reminder that the march of technology takes a long time.