> But our SGX-isolated VMs have one significant advantage over the other VM technologies we got used to in the last decade or so – namely those VMs can now be impenetrable to any other entity outside of the VM. No kernel or hypervisor can peek into its memory. Neither can the SMM, AMT, or even a determined physical attacker with DRAM emulator, because SGX automatically encrypts any data that leave the processor, so everything that is in the DRAM is encrypted and useless to the physical attacker.

So basically, when used for real security, it is a more modular substitute for a subset of the functionality of secure boot that has the dubious benefit of protecting against an attacker with a DRAM emulator - except it currently doesn't even do that, because there is no way to secure user input.

When used for DRM, of course, it works just fine. It's basically the rebirth of the whole Trusted Computing brouhaha, but worse, because it doesn't depend on securing the entire boot path and is thus actually practical to implement in some browser plugin. While it will not be possible to depend on this feature being present in users' CPUs for the next few years, it could become very dangerous after that.

Ugh.