5 ms·

I feel dumb for asking this, but is this really something that's not supposed to be possible from software? My assumption was always that if you overlock, under

I feel dumb for asking this, but is this really something that's not supposed to be possible from software? My assumption was always that if you overlock, undervolt, etc. then (a) you already have high-privileged code running, and (b) anything can go wrong from crashes to physically breaking your CPU, so I'm not really shocked (not sure if pun intended) to hear undervolting can damage the software state. Should I be?

saagarjha 7y ago
> you already have high-privileged code running I just glanced at the abstract, but they seem to be attacking the SGX enclave, which is supposed to be isolated even from privileged code.
- userbinator 7y ago
  ...in other words, they attacked the horribly user-hostile anti-feature whose real practical purpose is DRM, and so I certainly think nothing of value was lost. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
  - saagarjha 7y ago
    There’s been a couple of non-DRM uses of SGX, which I’m sure you’ve seen. And regardless of what it’s being used for, I think you know it’d be more productive to talk about the attack rather than potential uses of what they’re attacking.
  - baby 7y ago
    Is SGX actually used by DRMs? I read that TPMs were designed for DRMs as well and ended up being used for whole different purposes (secure boot, disk encryption)
    - dnautics 7y ago
      I read somewhere that Netflix drm runs in sgx and they're basically the only ones.
      - tedunangst 7y ago
        I read that Netflix doesn't use SGX.
  - achamayou 7y ago
    There are many interesting uses for enclaves, most of which have nothing to do with DRM. A good example is Signal’s secure value recovery mechanism: https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
    - fulafel 7y ago
      Really interesting use of SGX. It says at the time of writing that they haven't decided if they'll use it in Signal yet, are there updates?
      - achamayou 7y ago
        Not that I know, I suspect a limiting factor is that there aren’t many cloud providers with good support for SGX at the moment.
    - trasz 7y ago
      It is interesting and useful as a workaround for existing situation, ie running under untrusted OS. It’s not useful as a proper solution (as opposed to a hack/workaround). Except for DRM.
      - achamayou 7y ago
        Why not? An OS is a large beast, it’s a massive TCB. Much easier to audit a small amount of code running in an enclave with few dependencies.
        trasz 7y ago
        Because, as shown by SGX, it doesn’t work. And if it did work, it would lead to a whole new magnitude of the malware problem - malware protected from you by hardware. The right way to do it is the other way round: have a trusted hypervisor and run your untrusted OS in it. See TrustZone for example.
        7y ago
  - matheusmoreira 7y ago
    Not sure why you're being downvoted. Software running on the user's machine has no business keeping secrets from the user. This "feature" is the antithesis of computing freedom as we know it. Trusted computing is at least salvageable. The issue is not the technology but who owns the keys. If users can install their own keys, the technology will empower them with increased security. SGX cannot be used to empower the user like this. It's specifically designed to protect software from the user.
    - achamayou 7y ago
      No, the user is still in control of what they execute on the machine, whether it is run in enclave or not. If anything, because it is deliberately unable to patch itself, software running in an enclave gives more control and auditability to a user who can know exactly what code they are running. Importantly, a user who does not fully trust the machine administrator can still maintain integrity and confidentiality over their computation. SGX memory encryption keys are ephemeral, they are generated at boot, and they do not need to be owned by anyone to be useful, on the contrary!
hannob 7y ago
It's not a dumb question, not at all. Processor vendors have been trying to tell us that they can protect parts of the CPU from its user. Intels version of that is called SGX. There are very few good use cases of this. Also it doesn't really work. But there are gazillion ways to attack it, so plenty of papers can be written about it.
- baby 7y ago
  To add to this ^ imagine that your enclave is computing a wrong result and then signing this result along with an attestation that it ran the correct code. This could be fine if the computation first goes through a consensus mechanism that tolerates faults, but could be devastating otherwise.
- lallysingh 7y ago
  Sounds like a security Perpetual Motion Machine.

saagarjha 7y ago

> you already have high-privileged code running I just glanced at the abstract, but they seem to be attacking the SGX enclave, which is supposed to be isolated even from privileged code.

userbinator 7y ago
...in other words, they attacked the horribly user-hostile anti-feature whose real practical purpose is DRM, and so I certainly think nothing of value was lost. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
- saagarjha 7y ago
  There’s been a couple of non-DRM uses of SGX, which I’m sure you’ve seen. And regardless of what it’s being used for, I think you know it’d be more productive to talk about the attack rather than potential uses of what they’re attacking.
- baby 7y ago
  Is SGX actually used by DRMs? I read that TPMs were designed for DRMs as well and ended up being used for whole different purposes (secure boot, disk encryption)
  - dnautics 7y ago
    I read somewhere that Netflix drm runs in sgx and they're basically the only ones.
    - tedunangst 7y ago
      I read that Netflix doesn't use SGX.
- achamayou 7y ago
  There are many interesting uses for enclaves, most of which have nothing to do with DRM. A good example is Signal’s secure value recovery mechanism: https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
  - fulafel 7y ago
    Really interesting use of SGX. It says at the time of writing that they haven't decided if they'll use it in Signal yet, are there updates?
    - achamayou 7y ago
      Not that I know, I suspect a limiting factor is that there aren’t many cloud providers with good support for SGX at the moment.
  - trasz 7y ago
    It is interesting and useful as a workaround for existing situation, ie running under untrusted OS. It’s not useful as a proper solution (as opposed to a hack/workaround). Except for DRM.
    - achamayou 7y ago
      Why not? An OS is a large beast, it’s a massive TCB. Much easier to audit a small amount of code running in an enclave with few dependencies.
      - trasz 7y ago
        Because, as shown by SGX, it doesn’t work. And if it did work, it would lead to a whole new magnitude of the malware problem - malware protected from you by hardware. The right way to do it is the other way round: have a trusted hypervisor and run your untrusted OS in it. See TrustZone for example.
        7y ago
- matheusmoreira 7y ago
  Not sure why you're being downvoted. Software running on the user's machine has no business keeping secrets from the user. This "feature" is the antithesis of computing freedom as we know it. Trusted computing is at least salvageable. The issue is not the technology but who owns the keys. If users can install their own keys, the technology will empower them with increased security. SGX cannot be used to empower the user like this. It's specifically designed to protect software from the user.
  - achamayou 7y ago
    No, the user is still in control of what they execute on the machine, whether it is run in enclave or not. If anything, because it is deliberately unable to patch itself, software running in an enclave gives more control and auditability to a user who can know exactly what code they are running. Importantly, a user who does not fully trust the machine administrator can still maintain integrity and confidentiality over their computation. SGX memory encryption keys are ephemeral, they are generated at boot, and they do not need to be owned by anyone to be useful, on the contrary!

hannob 7y ago

It's not a dumb question, not at all. Processor vendors have been trying to tell us that they can protect parts of the CPU from its user. Intels version of that is called SGX. There are very few good use cases of this. Also it doesn't really work. But there are gazillion ways to attack it, so plenty of papers can be written about it.

baby 7y ago
To add to this ^ imagine that your enclave is computing a wrong result and then signing this result along with an attestation that it ran the correct code. This could be fine if the computation first goes through a consensus mechanism that tolerates faults, but could be devastating otherwise.
lallysingh 7y ago
Sounds like a security Perpetual Motion Machine.