Thoughts on Intel's upcoming Software Guard Extensions (Part 1)

Re:Thoughts on Intel's upcoming Software Guard Extensions (P... by RDeckard on Sunday September 08, 2013 @09:57PM (#6351423)

I must be missing something, but how does one bootstrap an enclave securely? A malicious VM can emulate the new SGX mode, but lift the restriction of not being able to access the enclave's memory.

[ Parent | on HN ]

Re:Thoughts on Intel's upcoming Software Guard Extensions (P... by anologwintermut on Sunday September 08, 2013 @10:07PM (#6351454)

TXT handles this with a TPM that stores a key and has hardware to check that the proper instructions executed and signs an attestation to that fact with its key. SGX doesn't need a TPM. Does it possibly have similar hardware on die?

[ Parent | on HN ]

Re:Thoughts on Intel's upcoming Software Guard Extensions (P... by sweis on Sunday September 08, 2013 @11:59PM (#6351766)

SGX adds the ability to attest and seal individual enclaves, with a root attestation key in the CPU die: https://docs.google.com/file/d/0B_wHUJwViKDaSUV6aUcxR0dPejg/...

This key has some similarities to a TPM EK / AIK, but rather than PCRs for the measurements they have a cryptographic log of the enclave.

[ Parent | on HN ]