Re: about smartcards (Re: TPM support status ?)

[Robert Millan <rmh@aybabtu.com>]

On Thu, Aug 20, 2009 at 08:35:34PM +0200, decoder wrote:
> Robert Millan wrote:
>> SmartCards are a single-purpose device.  Users don't install software in them,
>>   
> You don't install software in a TPM module either.
>> and they don't have any user interface (other than a button or so) that could
>> be used to implement DRM
> This is wrong. Smartcards of course have a an interface to interact with  
> them.

Yes, but it's usually just a button or similar.  It doesn't behave like a
computer.

The same happens with your oven or your fridge.  They run software and have a
user interface, but they don't work like a computer.

> And yes, you could use a Smartcard to do DRM.

No, you can't.  What you can do is use the smartcard for authentication
in a computer that has been previously rigged against its user.  In this
case it is the computer which implements DRM, not the card.

>> , so it's not an issue if their owners can't modify
>> their firmware (which could even be in a ROM).
>>   
> The TPM can't modify anything either. A TPM is a _passive_ crypto module.

What does this have to do with anything?  Being passive doesn't prevent it
from being used in coercion schemes like:

  "Either you use this TPM to certify you're running Crippleware Reader
   2.0 or you can't read this book"

-- 
Robert Millan

  The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and
  how) you may access your data; but nobody's threatening your freedom: we
  still allow you to remove your data and not access it at all."