4 ms·
Intel SGX is a Secure Enclave embedded in Intel CPU, which aims to provide secure and trust computation environment. For example, storing and processing crypto
by xucheng 7y ago
Intel SGX is a Secure Enclave embedded in Intel CPU, which aims to provide secure and trust computation environment. For example, storing and processing cryptography secret keys, etc. It is similar to the enclave in Apple A chips used in Touch ID/Face ID. Currently, there is no wide adoption of SGX in the production environments, mainly due to the attacks like this.
In this attack, the researchers found that by adjusting the voltage and clock frequencies of the CPU, they are able to generate errors inside SGX enclave and recover the secret keys inside.
- mehrdadn 7y ago> Currently, there is no wide adoption of SGX in the production environments, mainly due to the attacks like this. How long have these attacks been around? I only started hearing about them maybe like... in the past week or so? Nothing remotely close to explaining why these aren't used in production.
- saagarjha 7y agoThere are other attacks (https://arxiv.org/pdf/1802.09085.pdf https://arxiv.org/pdf/1802.09085.pdf), but I doubt they’re the major driving force behind lagging adoption.
- Legogris 7y agoIME lack of adoption is more due to lack of tooling and integration with popular languages and libraries. Also, the domains that have the most to benefit from SGX (heavily regulated ones like healthcare) tend to be very slow adopters of new technology. I guess there is definitely some level of concern for sidechannel attacks, given Intel's track record, but I don't think that's whats been holding back adoption.
- saagarjha 7y agoHow could healthcare benefit from SGX?
- Legogris 7y agoStrengthened protection for patient data.
- throwaway2048 7y agoIt also requires a very expensive license from intel, and to allow them partial control of your code via codesigning.
- thu2111 7y agoNo it doesn't. Getting a whitelisted code signing key just requires you to agree that you won't distribute malware. You pay nothing for it and Intel don't see the code you sign. Please don't make things up because they "sound right".
- dboreham 7y agoAre there non-Intel remote attestation servers now?
- thu2111 7y agoOnly Intel know what chips they've manufactured and what microcode patch levels are currently considered secure, so that wouldn't make much conceptual sense. But the new DCAP feature lets you run some of the RA infrastructure yourself, yes.