Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Modern intel (and probably most other) boards use hardware scramblers for other reasons (storing all zeros or all ones causes signal integrity issues / current spikes), and secure the scrambling routine with a different code at each boot.

So, unless I’m mistaken, cooling the ram and moving to another doesn’t work any more.



There are two types of scrambling here - one is the bitswapping and byteswapping that you use to make DDR3/4 routing possible. The other is the whitening function for high speed data that ensures you don't have long sequences of the same value without a transition. The latter is a simple pseudorandom scrambler with a fixed random seed generated at boot. It is not cryptographically secure. The former is a simple substitution and quite easy to reverse (and trivial if you have either a schematic or a board to reverse). Both are deterministic and extremely vulnerable to known plaintext attacks. This is not a security feature.

Source: I'm working on a DDR4 layout right now, and the memory controller scrambling and swapping functions are documented in publically-available intel datasheets (for example, see https://www.intel.com/content/dam/www/public/us/en/documents... sections 2.1.6 and 2.1.8)


Seriously interesting. Any pointers?




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: