[HN Gopher] Intel Assured Supply Chain Product Brief
___________________________________________________________________
Intel Assured Supply Chain Product Brief
Author : aw-engineer
Score : 46 points
Date : 2026-03-30 13:00 UTC (4 days ago)
(HTM) web link (www.intel.com)
(TXT) w3m dump (www.intel.com)
| throwway120385 wrote:
| So only for some of their processors? This doesn't seem to have
| anything to do with their bid to become a foundry.
| khuey wrote:
| From skimming the brief it sounds like the target for this is
| Western government customers?
| TZubiri wrote:
| Interestingly it's just for processors, I would have been down to
| read about at least a product that 'assures' the supply chain of
| a broader part of the stack, at least the hardware.
|
| It's just not enough to make me care, I'd probably just rely on
| the packaging, and vendor procurement, but I guess this is an
| additional tool.
| hypercube33 wrote:
| I think Lenovo has or had(?) ThinkShield to check your laptops
| build and shipping history or something.
| chihuahua wrote:
| 4/2/26 Build complete at Lenovo factory Shenzen-149
|
| 4/3/26 Shipped to MSS facility Beijing
|
| 4/5/26 Received at MSS facility Beijing
|
| 4/5/26 Special firmware upgrade performed at MSS facility
|
| 4/7/26 Shipped from MSS facility Beijing to customer in
| United States via Fedex
| jeffrallen wrote:
| ...which is exactly the same way backdoored Cisco hardware
| got to China.
| kube-system wrote:
| I'd think that an integrator would need to attest to their own
| supply chain controls. I'm not really sure how Intel could
| provide anything of value to validating the supply chain of
| their downstream customers.
|
| Edit: looks like they have (one?) partnership in place to help
| an OEM do that: https://news.lenovo.com/pressroom/press-
| releases/intel-colla...
| kevincloudsec wrote:
| the attestation is a real step forward for silicon provenance.
| the problem is your board, firmware, bmc, and nic still come
| through the same opaque supply chain as before. the processor is
| rarely where a hardware implant goes.
| saltcured wrote:
| The brief directly cites some of the compliance frameworks which
| have supply chain risk controls in them.
|
| This topic is kind of fascinating though. Considering the mindset
| from the Reflections on Trusting Trust paper, I do wonder how you
| bootstrap an assured supply chain like this. I know verification
| of chips and designs has been an active research area. But is
| there any formal solution to the larger problem of all the
| transitive dependencies of design and control of production?
|
| How do you get there if you weren't already doing it from the
| start? It isn't just the chain of custody of the new chip that
| comes out. What about all the chips used in the production
| process and in the chain-of-custody tracking process? What about
| the chain of custody of all the design and process control
| artifacts that influenced the implementation of these processes?
| And the chips used to develop and manage those artifacts...
|
| It feels like it most likely is a "turtles all the way down" kind
| of myth. Eventually, do you just give up and hope your layers of
| compliance frameworks have produced some kind of defense in depth
| cocoon?
|
| I'm not sure it is even all that asymmetric. Do all the layers of
| compliance ritual disrupt the attacker more aggressively than it
| disrupts the desired production? There is a strong whiff of
| regulatory capture to these compliance frameworks, making it hard
| to divine how much it really blocks attackers versus upstart
| competitors...
| peyton wrote:
| There's a role for humans vis-a-vis accountability. Simply
| recording whose head goes on a pike for every step if something
| going wrong can be effective too.
| jandrewrogers wrote:
| In the case of the US, they've been maintaining assured supply
| chains fully sourced in the US for several decades so they've
| been able to bootstrap it. It is one of the reasons a domestic
| manufacturer exists for every kind of computing even though
| most has moved to Asia. It isn't a coincidence, for example,
| that Micron is based in Idaho.
|
| Bootstrapping that from scratch today would be slow. The more
| feasible path is to use an existing assured supply chain to
| bootstrap initial capability and then swap out those bits with
| your own.
___________________________________________________________________
(page generated 2026-04-03 23:02 UTC)