4 ms·

Unaddressed: that the reliance on Intel SGX for MobileCoin's consensus-system gives Intel a kill-switch for the network.

by gojomo 6y ago

hiq 6y ago
I think this point is too technical to be addressed in this blog post, and it's already addressed in technical documents / talks from MobileCoin. In short, and IIUC, no Intel SGX means a bit less privacy but is still ok. In particular, it's not a kill-switch. Happy to be corrected though, I still know little about MobileCoin.
- gojomo 6y ago
  It's true an SGX compromise means most of the MobileCoin privacy goals are still met. But dsome compromises would open up new methods of traffic analysis, and the SGX-dependency still makes the consensus process dependent on Intel's trustworthy key-management. If I understand correctly, Intel could (if compromised or untrustworthy): * revoke any node's SGX keys - knocking any number of consensus nodes out at zero cost * create false attestations of what code was run (which would presumably be detectd eventually) * dominate the consensus mechanism with its hand-picked SGX nodes Among other things, this means Intel could turn off the MobileCoin chain, if commanded to do so. (I could be somewhat off on some of this – if so, corrections with explanations very welcome.) So, if your threat model is "Intel Inc is always trustworthy & secure", Signal & MobileCoin are wonderful. If you have doubts about Intel's trustworthiness/security, the designed privacy properties start to degrade.
ghughes 6y ago
Signal's increasing reliance on SGX is the elephant in the room. They keep announcing new features that require sending your cryptographic keys to someone else's "super trustworthy" computer.
- hiq 6y ago
  What alternative do you suggest?
  - ghughes 6y ago
    Not developing features that pretend secure remote computation is a real thing.
    - hiq 6y ago
      You don't think the sealed sender feature is an improvement at all? Nobody relies on it. But if we can make an attack 10 times more expensive (because we can't prevent it completely), why not do it? Secure remote computation is better than nothing. I'd start having problem with it when people rely on it when there are better solutions, but that hasn't been the case so far, AFAICT.

Unaddressed: that the reliance on Intel SGX for MobileCoin's consensus-system gives Intel a kill-switch for the network.

by gojomo 6y ago

Unaddressed: that the reliance on Intel SGX for MobileCoin's consensus-system gives Intel a kill-switch for the network.

hiq 6y ago

I think this point is too technical to be addressed in this blog post, and it's already addressed in technical documents / talks from MobileCoin. In short, and IIUC, no Intel SGX means a bit less privacy but is still ok. In particular, it's not a kill-switch. Happy to be corrected though, I still know little about MobileCoin.

gojomo 6y ago
It's true an SGX compromise means most of the MobileCoin privacy goals are still met. But dsome compromises would open up new methods of traffic analysis, and the SGX-dependency still makes the consensus process dependent on Intel's trustworthy key-management. If I understand correctly, Intel could (if compromised or untrustworthy): * revoke any node's SGX keys - knocking any number of consensus nodes out at zero cost * create false attestations of what code was run (which would presumably be detectd eventually) * dominate the consensus mechanism with its hand-picked SGX nodes Among other things, this means Intel could turn off the MobileCoin chain, if commanded to do so. (I could be somewhat off on some of this – if so, corrections with explanations very welcome.) So, if your threat model is "Intel Inc is always trustworthy & secure", Signal & MobileCoin are wonderful. If you have doubts about Intel's trustworthiness/security, the designed privacy properties start to degrade.

ghughes 6y ago

Signal's increasing reliance on SGX is the elephant in the room. They keep announcing new features that require sending your cryptographic keys to someone else's "super trustworthy" computer.

hiq 6y ago
What alternative do you suggest?
- ghughes 6y ago
  Not developing features that pretend secure remote computation is a real thing.
  - hiq 6y ago
    You don't think the sealed sender feature is an improvement at all? Nobody relies on it. But if we can make an attack 10 times more expensive (because we can't prevent it completely), why not do it? Secure remote computation is better than nothing. I'd start having problem with it when people rely on it when there are better solutions, but that hasn't been the case so far, AFAICT.