Dr Linton Salmon - The DARPA SSITH Program at DEFCON

In this presentation at the DEF CON 27 Voting Village, Dr. Linton Salmon, Program Manager at DARPA's Microsystems Technology Office, introduces the System Security Integration Through Hardware and Firmware (SSITH) program and invites the hacker community to evaluate its prototype hardware defenses. He opens at 05:00 by explaining the foundational philosophy of SSITH: rather than continuously patching software vulnerabilities, SSITH designs microarchitectures that eliminate entire classes of software exploits directly in silicon.

Dr. Salmon discusses why real-world offensive testing is critical at 10:00, stating that formal security proofs are insufficient without adversarial red-teaming by independent researchers. At 15:00, he demonstrates prototype FPGA systems implementing novel hardware protections against common vulnerability classes, including buffer overflows, return-oriented programming (ROP), code injection, and information leakage side channels.

He explains the crowdsourced testing engagement at 20:00, outlining the DEF CON bug bounty framework and inviting attendees to compromise the SSITH hardware prototypes. At 25:00, Dr. Salmon explores engineering tradeoffs between silicon area, clock speed, power consumption, and security guarantees. He concludes at 30:00 by addressing questions regarding how hardware-enforced memory safety distinguishes between malicious exploit primitives and benign developer bugs, highlighting applications for high-assurance electronic voting systems. (AI summary — Gemini Flash)