Are new AMD processors more secure than Intel ones?

Question

Since the discovery of Meltdown and Spectre, CPU security has been compromised and trust to the main manufacturers reduced, particularly Intel. 8 months later I wonder, what CPUs are more secure at this moment? Why? Have the patches achieved the objective? Personally, after the many security and privacy scandals published in the past year, my levels of information security and privacy paranoia have escalated.

Answer 1

They are both about equally terrible and still highly vulnerable to Spectre.

Unfortunately, you would have to have access to confidential design documents in order to even begin answering this question. From (quasi-privileged) anecdotal evidence, AMD used to be really bad with setting lock bits (MMIO/MSR defaults, if I recall correctly), whereas Intel puts a lot of effort into security. On the other hand, Intel has recently gotten rid of a lot of its security personnel and even outsourced the development of the ME to Israel instead of doing it in-house (for MEv11, I think).

In terms of architecture, they are quite different internally. I can't say whether or not the deep internal architecture (e.g. Intel using ports to send data to execution units, AMD using pipes) is relevant to security, but their co-processors are quite different. Intel uses its Management Engine (now called the Converged Security and Management Engine, or CSME) which, while bad, is not nearly as bad as people make it out to be (it actually does not have direct memory access^note, at least not by default, for various reasons, though it does have access to VGA and PS/2). The CSME was previously an ARCompact processor running ThreadX, but is now an i486/i586 hybrid (basically a little x86 core) running Minix. AMD on the other hand uses the PSP (Platform Security Processor), an ARM-based core which, if I recall, has absolute access to everything, including memory. Unlike the AMD PSP, the Intel CSME can be disabled, as people have recently discovered.

In the end, CPU security, and hardware security in general, is a new and emerging field. Both Intel and AMD are pretty equally vulnerable to all Spectre-class attacks (the gift that keeps on giving!), even if Intel is uniquely affected by Meltdown. I would say that, overall, both Intel and AMD are really, really insecure on an architectural level. ARM less so, and MIPS less so still. Of course, as we go to the more secure CPUs, we also come with lesser capabilities and performance. I personally go with Intel, mainly because there tends to be more research into Intel processors, so discoveries and leaked datasheets are far more likely to come from them than from AMD. That doesn't mean I consider Intel to be more secure. x86 security in general? Hic sunt dracones.

Answer 2

An answer that maybe requires less technical knowledge:

Spectre was discovered in 2007.
Spectre is a vulnerability that is based upon the instruction set architecture (ISA) of x86 processors.
The architecture of processors has not changed too much in the last 20 years.^{[citation needed]}
It was theoretically possible to discover Spectre in ~2010, but for a long time there was little focus on hardware security and hardware vulnerability exploitation.
If new AMD processors - which also have an x86 architecture - are built the same way, that older processors are built, it is very likely, that we will see new and/or similar vulnerabilities like Spectre.

This will only change if we see at least one of two things (but maybe we need both):

1. vendor's awareness for hardware security
2. a fundamental change in the ISA of modern processors