NGSCB (Palladium)

~ the eulogy ~

in the summer of 2002 i was eighteen and about to start computer engineering. palladium arrived that june as a magazine story rather than a product, and it never became anything else. there is nothing to remember using, because there was never anything to use. what there was instead was two years of argument, and the argument is the only part that left marks.

steven levy got the exclusive in newsweek in june 2002. microsoft was going to rebuild the trust model of the pc from the silicon upward, and the codename was palladium. by january 24 2003 the name was gone, retired over a trademark conflict and replaced with next-generation secure computing base, a phrase engineered to be impossible to chant at a protest. everyone kept calling it palladium anyway.

on may 5 2004, during winhec, the reporting turned. osnews ran the line that microsoft had killed ngscb. a product manager in the security division, mario juarez, went on the record saying it was alive and kicking, then explained the actual situation: customers and independent software vendors did not want to rewrite their applications against a new api. that is a shelving described as a survival. the architecture as announced never came back.

~ the dossier ~

~ what it was supposed to do ~

the design put a second kernel next to windows rather than inside it. the nexus was small on purpose, small enough to audit, and it ran trusted modules called nexus computing agents in a space the normal operating system could not reach into. curtained memory was the hardware half of that promise, pages the cpu itself would refuse to hand over to anything outside the agent that owned them.

the other two pieces are the ones that made people uneasy. sealed storage tied encrypted data to a specific machine in a specific software state, so a file could refuse to open on hardware it did not recognize. attestation let a remote server ask your computer what it was running and get a cryptographically signed answer. microsoft demonstrated the whole stack at winhec in 2003 with the nexus emulated in software, because the hardware to run it properly did not exist yet.

~ the backlash ~

ross anderson at cambridge published a trusted computing faq that read the design back to microsoft in plain language, and the plain language was not flattering. richard stallman renamed the whole category treacherous computing in october 2002, on the argument that the machine was being secured against its owner as much as for them. the specific fear was not the nexus. it was attestation plus sealed storage arriving on every consumer pc, which would let a file decide for itself which computers deserved to open it.

microsoft spent two years insisting that was not the plan and never fully won the point. in 2008 peter biddle, who had been on the project from the start, said publicly that public perception was the thing that ended it. the api that nobody would port to was the mechanism. the name was the wound.

~ what actually shipped ~

vista in 2007 carried the smallest survivable fragment: bitlocker, disk encryption that can use a trusted platform module to check that the boot files have not been altered. no nexus and no attestation anywhere near the consumer desktop. windows 8 added measured boot and uefi secure boot, both of them descendants of the boot-integrity idea with none of the second-kernel ambition attached.

the ending is worth sitting with. in june 2021 microsoft made a tpm 2.0 chip a hard requirement to install windows 11, which is the piece of hardware the 2002 protests were about. it went through with grumbling about old laptops and almost no argument about the principle. palladium was not wrong about where the pc was going. it was early, and it said so out loud while people were still willing to fight about it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »