<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Hello Joachim,</div><div><br></div><div>I agree with you : </div><div><br></div><div>No, of course, I don’t trust Xilinx implementation of PCIe as it is impossible to check the corresponding VHDL code.</div><div>Now, there are many « Free VHDL PCIe cores » available on OpenCore.</div><div><br></div><div>But in the project we want to develop, this may not be such a big problem : The workaround would be to cipher all the messages we exchange on the PCIe bus. </div><div><br></div><div>And in the particular project we are planing : It would mean using the PCIe bus to exchange TCP/IP paquets with the Secure TOR router : </div><div>- We would have a driver on the PC hooking TCP/IP stack packets to encrypt and send them to the PCIe TOR Router end-point, so if the PCIe has some backdoors, as we would cipher the data sent through it, these backdoors would be useless.</div><div><br></div><div>Do you agree with this approach ? </div><div><br></div><br><div><div>Le 6 août 2014 à 09:01, Joachim Strömbergson <<a href="mailto:joachim@secworks.se">joachim@secworks.se</a>> a écrit :</div><br class="Apple-interchange-newline"><blockquote type="cite"><fieldset style="padding-top:10px; border:0px; border: 3px solid #CCC; padding-left: 20px;"><legend style="font-weight:bold">Signé partie PGP</legend><div style="padding-left:3px;">Aloha!<br><br>★ STMAN ★ wrote:<br>> Hi Joachim & Linus & Lilith,<br>><br>> For the replacement of the Novena which is not « suitable » for<br>> prototyping secure TOR routers (Too many custom additionnal hardware<br>> to build for being fully operationnel), I am think for the moment to<br>> this develpment board :<br>><br>> <a href="http://www.em.avnet.com/en-us/design/drc/Pages/Xilinx-Spartan-6-FPGA-LX75T-Development-Kit.aspx">http://www.em.avnet.com/en-us/design/drc/Pages/Xilinx-Spartan-6-FPGA-LX75T-Development-Kit.aspx</a><br>><br>><br>><br>- It has all what is needed to do the job right. - It is not<br>> expensive. - It is suitable with its PCIexpress bus to fit in<br>> standard PC’s. - It has a standard FMC expansion connector :D<br><br>Avnet makes pretty good boards. But are you really considering using<br>PCIe for connectivity? AFAIK there are no complete PCIe open source<br>cores. Would you really trust the Xilinx PCIe macro?<br><br>I assumed that given the security requirements you would have, the<br>machine we are discussing would either be:<br><br>- A simple addon connected using a fairly simple though also fairly slow<br>interface to a common PC.<br><br>- A complete, self contained system.<br><br>I don't think the Avnet board is imho not very usable for either of<br>those to solutions.<br><br>In either case I would use the Novena and the TerasIC boards (for<br>diversity) to develop the main functionality (key signing for example).<br>And then in parallel design a more application specific board. For<br>example using one of the TerasIC boards and remove the cruft not needed<br>and add things like manual switches directly in the path of a key store<br>flash to block remote changes.<br><br>I really like the TerasIC boards. They are easy to use (connects cleanly<br>to the tools) and have good documentation including schematics,<br>reference designs etc.<br><br>--<br>Med vänlig hälsning, Yours<br><br>Joachim Strömbergson - Alltid i harmonisk svängning.<br>========================================================================<br> Joachim Strömbergson<span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> Secworks AB<span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> <a href="mailto:joachim@secworks.se">joachim@secworks.se</a><br>========================================================================</div></fieldset><br></blockquote></div><br></body></html>