a cryptographically strong, pseudo-random number sequence to the HC. This sequence must
be long enough so that it will occupy all of the memory, cache and register storage capacity of
the HC. Then the HC must be able to replay the identical sequence back to its originator,
showing that the entire capacity of the HC was cleared by being filled with the pseudo-random
number sequence.
is verified by the Interior and Exterior Memory Clearing Verifiers (IMCV and EMCV). Both
the MCI and both MCVs are external to the HC, and may conveniently be located within the
SM. There are two MCVs, to prevent the failure of either one from compromising the security
of the SNC. Each MCV is hosted on a different CPU. The ESMCPU hosts the MCI.
Otherwise, either CPU might fail and pass messages between the HC and the external network,
without the other CPU to act as a check. Therefore, the interior CPU must include a conduit
between the HC and the exterior CPU.
memory clearing. If the INA is implemented with direct memory access (DMA) to the HC, then
the ISMCPU can examine HC memory directly to verify clearing. The converse should be
forbidden: it should be impossible for the HC to access SM memory, except perhaps for HC-
ISMCPU message buffers whose contents must be modified or viewed by the HC in any case.