11 ms·

It is great to see interest in Keystone on here! A couple comments that may help clarify what we are aiming for and where we are right now. Keystone is a (stil

It is great to see interest in Keystone on here! A couple comments that may help clarify what we are aiming for and where we are right now. Keystone is a (still pretty early!) research project and enclave/TEE framework for general use on RISC-V processors. We'll be using it ourselves heavily as a platform for secure hardware and systems research. There are a couple logical parts to Keystone: - The security monitor (riscv-pk/sm) is the core of this, and is the TCB for the entire system. It provides privacy by isolating enclave memory from the rest of the system. - The SDK/runtime provides one possible (minimal) example of how to target and host applications in the enclave, we'll be making new tools and runtimes as targets going forward. - The demo, which uses our minimal sdk and runtime. The demo isn't particularly flashy, but demonstrates how to accomplish privacy and integrity against a malicious OS on a remote RISC-V machine. Right now we don't have protection mechanisms against side-channels and the like, but those are some of our next goals. We're excited to build a community around open-source secure enclave development on RISC-V and are actively looking for collaborators and other researchers. Expect to see significantly more documentation and information on keystone-enclave.org and docs.keystone-enclave.org in the next week. Also check out the slides from our recent talk here: https://keystone-enclave.org/files/keystone-risc-v-summit.pdf https://keystone-enclave.org/files/keystone-risc-v-summit.pd...

nickik 8y ago
Great project. I always try to post Keystone updates here :) Can you maybe compare this work with Hex Five MultiZone Security? Are the plans to integrate this into the Rocket (BOOM), Pulp, LowRisc and others SoCs? Can you do all that a modern IPhone Secure Enclave provides?
- sagark 8y ago
  Keystone has been demonstrated to run on Rocket Chip on FPGAs using FireSim (https://fires.im https://fires.im). There are docs on how to do so here: http://docs.keystone-enclave.org/en/latest/Getting-Started/Running-Keystone-with-FireSim.html http://docs.keystone-enclave.org/en/latest/Getting-Started/R... There's also a branch of BOOM (https://github.com/riscv-boom/riscv-boom/tree/secureboom https://github.com/riscv-boom/riscv-boom/tree/secureboom) that supports Keystone, we're just waiting for it to be merged into master.

nickik 8y ago

Great project. I always try to post Keystone updates here :) Can you maybe compare this work with Hex Five MultiZone Security? Are the plans to integrate this into the Rocket (BOOM), Pulp, LowRisc and others SoCs? Can you do all that a modern IPhone Secure Enclave provides?

sagark 8y ago
Keystone has been demonstrated to run on Rocket Chip on FPGAs using FireSim (https://fires.im https://fires.im). There are docs on how to do so here: http://docs.keystone-enclave.org/en/latest/Getting-Started/Running-Keystone-with-FireSim.html http://docs.keystone-enclave.org/en/latest/Getting-Started/R... There's also a branch of BOOM (https://github.com/riscv-boom/riscv-boom/tree/secureboom https://github.com/riscv-boom/riscv-boom/tree/secureboom) that supports Keystone, we're just waiting for it to be merged into master.