FAQ Friday

And the hardware root of trust, first, is a chip. It is a piece of secure silicon. We use the NXP LPC55. That chip is able to, importantly, keep a secret.

And that chip, we are able to uniquely program its device ID in the factory such that we can recognize it, and it can recognize the software that runs on that root of trust.

That’s where it begins. The root of trust is able to know that what I am loading has been signed. It’s been signed by Oxide. I can trust it.

Then that little bit is able to attest to what runs on the service processor. What runs on the service processor can then attest what runs on the actual host CPU.

And because uniquely at Oxide, we have the entire stack from that hardware root of trust, through the service processor, into the host OS, into the control plane, and into running VMs. So we are able to plumb those attestations all the way up to the running VM.

So a VM running on an Oxide rack can know that it’s running on the stack that it thinks it is running on. This is extremely powerful.

Go check out our RFD 605 for all of the details, because there are a lot of details involved in getting this right, because you need to own not just the hardware, but also the software, and you need to deliver it as a unified system.

Thanks, and see you next time!