News for hackers. Stuff that matters.

A comment on TRESOR Runs Encryption Securely Outside RAM. Parent comment

Re:TRESOR Runs Encryption Securely Outside RAM by codex on Friday September 27, 2013 @02:37PM (#6458694)
If you can't trust the TPM, can you trust Intel's debug registers to be secure?

Long term I suspect that this kind of thing will use Intel's Software Guard Extensions (SGX), which creates a trusted enclave of code and data that not even the kernel nor the hypervisor can access.

[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by andyjohnson0 on Friday September 27, 2013 @02:57PM (#6458815)
A couple of interesting articles on SGX:

http://theinvisiblethings.blogspot.co.uk/2013/08/thoughts-on...

http://theinvisiblethings.blogspot.co.uk/2013/09/thoughts-on...

[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by codex on Friday September 27, 2013 @04:51PM (#6459487)
The second article is quite alarming. Don't run any code in an enclave which you didn't compile yourself! One may not even be able to use a virtual machine to peer inside an enclave by emulating SGX: the software could demand a valid public key stored uniquely in every Intel chip and signed by Intel's private key, which a hypervisor would not have.
[ Parent | on HN ]