The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key
Itās been a longtime feature of the annual Defcon hacker conference that attendees come away not only with knowledge of new software vulnerabilities and hacking
Itās been a longtime feature of the annual Defcon hacker conference that attendees come away not only with knowledge of new software vulnerabilities and hacking techniques but also an elaborately designed conference badgeāoften electronic masterpieces embedded with intricate puzzles, complex crypto challenges, hidden Easter eggs, and even the mechanical gear trains of a watch. Each yearās badge creator endeavors to top previous designs and blow the minds of hard-to-impress hackers. But this yearās badges take a different tack. Instead of the badge designs being the star, itās what is inside the hardware that will really stand out. This year, Defcon asked legendary hardware hacker Andrew ābunnieā Huang to create the badgesārevealed here for the first timeāand they include an innovative open source chip that Huang designed and that aims to do no less than advance the state of security, transparency, and trustworthiness in computing. But the chip isn't just part of the badge.
Its core module can be removed and used after the conference as a hardware security token, giving the badge a second life beyond Defcon. The chipācalled the Baochip-1 is a āmostlyā open source microcontroller that has been three years in the making and fulfills Huangās years-long dream of making a chip whose security is verifiable. Huang has published the source code for the Baochipās operating system, firmware, processor core, cryptographic engines, and input-output system, on GitHub, making these components available for inspection and use. The chip is also packaged so that researchers can peer inside to check the silicon itself and compare what they see against the published design, rather than having to trust that the manufactured chip is what the designers intended. Computer chips are traditionally black-box components with an opaque casing that obscures their circuitry. Even previous open source chips that made their specs and code available for users to examine were encased in impermeable plastic, creating a supply-chain problem.
Users had to trust that nothing changed during the manufacturing stage of the chip, such as a backdoor component being added to it. Unlike conventional chips encased in opaque plastic, the Baochip is packaged so that infrared light can be shone through the back of the silicon, allowing the chip's internal structures to be visually inspected. Infrared image of the Baochip-1x mounted on a circuit board. Courtesy of Andrew ābunnieā Huang Huang plans to demonstrate the technique at the conference, allowing attendees to inspect the chip under an infrared light. āI've been doing a bunch of stuff along the lines of trust and silicon and verification transparencyā for years, Huang tells WIRED. "It's all ⦠this kind of story arc I've been on ⦠to try and get a chip that we can trust down to the very core, down to the transistor ⦠You can actually ⦠see the RAM arrays ⦠on the chip.ā Build-a-Chip Building a new chip is an expensive project that can cost millions of dollars for fabrication.
