3 ms·
You still are just a trust leaf, not the root. The root is a ROM you cannot read or change on the Intel side, so no trust control there (only delegated which fo
by oneplane 7y ago
You still are just a trust leaf, not the root. The root is a ROM you cannot read or change on the Intel side, so no trust control there (only delegated which for some people is no trust at all). With no ability to verify it, an exploit like this would not be something you can detect and as such breaks the trust chain.
- dboreham 7y agoIf you're talking about SGX the root is really the Intel-run remote attestation servers, no?
- oneplane 7y agoYes and no, the SGX flow models a dual-root method where two PKI roots must be trusted for success, and at the same time the SGX is only as safe as the microcode is, which can be overridden at this point. SGX with CPU-signature and Intel-signature can still be faked when you can compromise the CPU and SGX and still run the signing routines. Edit: I wonder if there is any feasible way one could do this without trusting the CPU at all, but I suppose that completely defeats the point.
- dboreham 7y agoHmm. I didn't realize the key, or at least the signing function, was in the microcode. So if the microcode can be changed by an attacker, they can have it sign <fake code signature> but go ahead and run <evil code> instead?
- oneplane 7y agoYes, and that was supposed to be protected by CSME and ACM, but because those can be circumvented, so can microcode upgrades. Normally a microcode update would be verified as well, but since it has been hacked in the past and CSME verification can now be bypassed it would probably be a matter of time. It used to be the case that an internal ROM with a unique on-time programmable entry that can only be read internally was safe enough, but with decapping, gliching and breaking PKI chains that is getting weaker and weaker.