The brief directly cites some of the compliance frameworks which have supply chain risk controls in them.
This topic is kind of fascinating though. Considering the mindset from the Reflections on Trusting Trust paper, I do wonder how you bootstrap an assured supply chain like this. I know verification of chips and designs has been an active research area. But is there any formal solution to the larger problem of all the transitive dependencies of design and control of production?
How do you get there if you weren't already doing it from the start? It isn't just the chain of custody of the new chip that comes out. What about all the chips used in the production process and in the chain-of-custody tracking process? What about the chain of custody of all the design and process control artifacts that influenced the implementation of these processes? And the chips used to develop and manage those artifacts...
It feels like it most likely is a "turtles all the way down" kind of myth. Eventually, do you just give up and hope your layers of compliance frameworks have produced some kind of defense in depth cocoon?
I'm not sure it is even all that asymmetric. Do all the layers of compliance ritual disrupt the attacker more aggressively than it disrupts the desired production? There is a strong whiff of regulatory capture to these compliance frameworks, making it hard to divine how much it really blocks attackers versus upstart competitors...
In the case of the US, they've been maintaining assured supply chains fully sourced in the US for several decades so they've been able to bootstrap it. It is one of the reasons a domestic manufacturer exists for every kind of computing even though most has moved to Asia. It isn't a coincidence, for example, that Micron is based in Idaho.
Bootstrapping that from scratch today would be slow. The more feasible path is to use an existing assured supply chain to bootstrap initial capability and then swap out those bits with your own.
There’s a role for humans vis-à-vis accountability. Simply recording whose head goes on a pike for every step if something going wrong can be effective too.
the attestation is a real step forward for silicon provenance.
the problem is your board, firmware, bmc, and nic still come through the same opaque supply chain as before.
the processor is rarely where a hardware implant goes.
Interestingly it's just for processors, I would have been down to read about at least a product that 'assures' the supply chain of a broader part of the stack, at least the hardware.
It's just not enough to make me care, I'd probably just rely on the packaging, and vendor procurement, but I guess this is an additional tool.
I’d think that an integrator would need to attest to their own supply chain controls. I’m not really sure how Intel could provide anything of value to validating the supply chain of their downstream customers.
The brief directly cites some of the compliance frameworks which have supply chain risk controls in them.
This topic is kind of fascinating though. Considering the mindset from the Reflections on Trusting Trust paper, I do wonder how you bootstrap an assured supply chain like this. I know verification of chips and designs has been an active research area. But is there any formal solution to the larger problem of all the transitive dependencies of design and control of production?
How do you get there if you weren't already doing it from the start? It isn't just the chain of custody of the new chip that comes out. What about all the chips used in the production process and in the chain-of-custody tracking process? What about the chain of custody of all the design and process control artifacts that influenced the implementation of these processes? And the chips used to develop and manage those artifacts...
It feels like it most likely is a "turtles all the way down" kind of myth. Eventually, do you just give up and hope your layers of compliance frameworks have produced some kind of defense in depth cocoon?
I'm not sure it is even all that asymmetric. Do all the layers of compliance ritual disrupt the attacker more aggressively than it disrupts the desired production? There is a strong whiff of regulatory capture to these compliance frameworks, making it hard to divine how much it really blocks attackers versus upstart competitors...
In the case of the US, they've been maintaining assured supply chains fully sourced in the US for several decades so they've been able to bootstrap it. It is one of the reasons a domestic manufacturer exists for every kind of computing even though most has moved to Asia. It isn't a coincidence, for example, that Micron is based in Idaho.
Bootstrapping that from scratch today would be slow. The more feasible path is to use an existing assured supply chain to bootstrap initial capability and then swap out those bits with your own.
There’s a role for humans vis-à-vis accountability. Simply recording whose head goes on a pike for every step if something going wrong can be effective too.
the attestation is a real step forward for silicon provenance. the problem is your board, firmware, bmc, and nic still come through the same opaque supply chain as before. the processor is rarely where a hardware implant goes.
So only for some of their processors? This doesn't seem to have anything to do with their bid to become a foundry.
From skimming the brief it sounds like the target for this is Western government customers?
Interestingly it's just for processors, I would have been down to read about at least a product that 'assures' the supply chain of a broader part of the stack, at least the hardware.
It's just not enough to make me care, I'd probably just rely on the packaging, and vendor procurement, but I guess this is an additional tool.
I’d think that an integrator would need to attest to their own supply chain controls. I’m not really sure how Intel could provide anything of value to validating the supply chain of their downstream customers.
Edit: looks like they have (one?) partnership in place to help an OEM do that: https://news.lenovo.com/pressroom/press-releases/intel-colla...
I think Lenovo has or had(?) ThinkShield to check your laptops build and shipping history or something.
4/2/26 Build complete at Lenovo factory Shenzen-149
4/3/26 Shipped to MSS facility Beijing
4/5/26 Received at MSS facility Beijing
4/5/26 Special firmware upgrade performed at MSS facility
4/7/26 Shipped from MSS facility Beijing to customer in United States via Fedex
...which is exactly the same way backdoored Cisco hardware got to China.