2 ms·
Intel SGX provides good isolation, it is still vulnerable to some side channel attacks, though it can be mitigated using a TSX hack. Of course, SGX is not quit
by xyzzyz 9y ago
Intel SGX provides good isolation, it is still vulnerable to some side channel attacks, though it can be mitigated using a TSX hack.
Of course, SGX is not quite available yet on server class CPUs.
- bleair 9y agoThe details aren't completely spelled out here but SGX looks to be an interesting extension of the idea of "virtual machine per block of code" https://software.intel.com/en-us/sgx https://software.intel.com/en-us/sgx It appears a runtime per-site-per-use license is required though.
- amluto 9y agoThe latest SDM strongly suggests that some future CPU will change this. Also, certain Linux x86 developers think that SGX support is vastly more likely to be acceptable upstream if this changes :)
- vitus 9y agoUnfortunately, SGX is also vulnerable to timing attacks that leak the private session key, which breaks the enclave security model. [0] http://www.sharcs-project.eu/m/documents/papers/a02-gotzfried.pdf http://www.sharcs-project.eu/m/documents/papers/a02-gotzfrie...