Re:Keystone – Open-source Secure Hardware Enclave
by nybble41 on Monday December 10, 2018 @11:35AM
(#18649059)
> I worry a bit about the current trend of how software vendors prefer to provide software as a web service when it doesn't really provide any technical benefit from the user's perspective.
Given that I'm not going to have control over the software either way, I'd rather it were running on their hardware, safely isolated on the other side of an Internet link, than on hardware which I payed for and nominally own but which has been partitioned off for someone else's use.
TEEs and TPMs have legitimate uses, but only so long as they are fully controlled by the owner of the device. That implies that there are no pre-installed keys which the owner doesn't control: to a remote exploiter, an emulated TEE/TPM should be indistinguishable from an official hardware device. Unfortunately this is not something that can be designed into the hardware, short of omitting the feature altogether, since non-owner-controlled keys could be installed at any point prior to final delivery. Erasing them after delivery is no good; the mere expectation that the manufacturer's key is present is enough to make treacherous remote attestation practical. Devices controlled by their owners should be the norm, not second-class citizens.
The problem is ultimately a social one, not a technical one, but the technical capabilities of TEEs and TPMs are empowering the wrong side. From one point of view they may just be tools, but they're tools which are more readily used against the interests of device owners then for them.
Given that I'm not going to have control over the software either way, I'd rather it were running on their hardware, safely isolated on the other side of an Internet link, than on hardware which I payed for and nominally own but which has been partitioned off for someone else's use.
TEEs and TPMs have legitimate uses, but only so long as they are fully controlled by the owner of the device. That implies that there are no pre-installed keys which the owner doesn't control: to a remote exploiter, an emulated TEE/TPM should be indistinguishable from an official hardware device. Unfortunately this is not something that can be designed into the hardware, short of omitting the feature altogether, since non-owner-controlled keys could be installed at any point prior to final delivery. Erasing them after delivery is no good; the mere expectation that the manufacturer's key is present is enough to make treacherous remote attestation practical. Devices controlled by their owners should be the norm, not second-class citizens.
The problem is ultimately a social one, not a technical one, but the technical capabilities of TEEs and TPMs are empowering the wrong side. From one point of view they may just be tools, but they're tools which are more readily used against the interests of device owners then for them.