Re:Keystone – Open-source Secure Hardware Enclave
by nickik on Friday December 07, 2018 @05:17AM
(#18626434)
Great project. I always try to post Keystone updates here :)
Can you maybe compare this work with Hex Five MultiZone Security?
Are the plans to integrate this into the Rocket (BOOM), Pulp, LowRisc and others SoCs?
Can you do all that a modern IPhone Secure Enclave provides?
Re:Keystone – Open-source Secure Hardware Enclave
by sagark on Friday December 07, 2018 @12:10PM
(#18629376)
Keystone has been demonstrated to run on Rocket Chip on FPGAs using FireSim (https://fires.im). There are docs on how to do so here:
http://docs.keystone-enclave.org/en/latest/Getting-Started/R...
There's also a branch of BOOM (https://github.com/riscv-boom/riscv-boom/tree/secureboom) that supports Keystone, we're just waiting for it to be merged into master.
Keystone is a (still pretty early!) research project and enclave/TEE framework for general use on RISC-V processors. We'll be using it ourselves heavily as a platform for secure hardware and systems research.
There are a couple logical parts to Keystone:
- The security monitor (riscv-pk/sm) is the core of this, and is the TCB for the entire system. It provides privacy by isolating enclave memory from the rest of the system.
- The SDK/runtime provides one possible (minimal) example of how to target and host applications in the enclave, we'll be making new tools and runtimes as targets going forward.
- The demo, which uses our minimal sdk and runtime.
The demo isn't particularly flashy, but demonstrates how to accomplish privacy and integrity against a malicious OS on a remote RISC-V machine. Right now we don't have protection mechanisms against side-channels and the like, but those are some of our next goals.
We're excited to build a community around open-source secure enclave development on RISC-V and are actively looking for collaborators and other researchers. Expect to see significantly more documentation and information on keystone-enclave.org and docs.keystone-enclave.org in the next week. Also check out the slides from our recent talk here: https://keystone-enclave.org/files/keystone-risc-v-summit.pd...