This was one of the few times someone came on Schneier's blog, heard high-assurance security techniques, and actually used them. Clive Robinson and I always talked diodes and physical separation. Markus Ottela's improvements on those concepts were extremely clever. He kept coming back with questions. We'd feed in things like mitigating covert channels. He'd apply it like that or his own take. Great stuff.
Note: It wasn't a Tor-based service back then. Anyone curious about his thinking might find those searching "site:schneier.com" "markus ottella" "tinfoil chat." It also needed a port to native code given he just knew Python.
In any case, it was one of strongest designs being, with right implementation, potentially NSA-proof with simple architecture vs hardware/software architectures that cost millions done by specialists. At best, attackers would keep trying to disrupt or brick the receiver and network components. Potentially some side channel leakage to watch for.
The usability was a problem. An integrated solution could put the boards in one device that user just set up like they do consumer routers. Supplier subversion and interdiction are more threatening. Alternatively, instructions on how to do this with components that come from many suppliers. Or both: one for each audience with their threat profiles. In any case, the real brilliance is that you can have usable high-security really fast vs building a seL4-based appliance.
Note: It wasn't a Tor-based service back then. Anyone curious about his thinking might find those searching "site:schneier.com" "markus ottella" "tinfoil chat." It also needed a port to native code given he just knew Python.
In any case, it was one of strongest designs being, with right implementation, potentially NSA-proof with simple architecture vs hardware/software architectures that cost millions done by specialists. At best, attackers would keep trying to disrupt or brick the receiver and network components. Potentially some side channel leakage to watch for.
The usability was a problem. An integrated solution could put the boards in one device that user just set up like they do consumer routers. Supplier subversion and interdiction are more threatening. Alternatively, instructions on how to do this with components that come from many suppliers. Or both: one for each audience with their threat profiles. In any case, the real brilliance is that you can have usable high-security really fast vs building a seL4-based appliance.