7 ms·

SGX is implemented on top of ME and relies on it for a substantial fraction of its functionality. You are right though that trustzone and sgx are both TEEs.

• namibj 5y ago
  I wish especially AMD would offer Java Card support through their PSP to the operating system, at least if the PSP is resistant to MMIO attacks on the integrity of the Java Card memory. Being able to open a Diffie-Hellman encrypted, mutual-signature-authenticated channel to a remote device to then receive an AES key for disk encryption is far better than some TPM header that can easily be sniffed with physical access. Would be even better if NVMe SSDs were able to authenticate themselves and let you transfer in a key over a DIffie-Hellman channel so sniffing the PCIe bus wouldn't deliver the key (or a non-PFS-encrypted encapsulated form of it) to an attacker. The speeds of NVMe SSDs unfortunately prevent LUKS from being cheap, and TCG Opal is kind of a joke from a security standpoint (doesn't even (seem to) specify that the provided "password" is used to derive a key, suggesting that it may just be used via a password hash to compare against a database entry to decide whether to unlock a disk encryption key). Even TPMs don't seem to encrypt the communications channel they use with the CPU/PSP, and they are often socketed which makes MITM attacks easy with physical access. If they'd offer Java Card, they'd at least be somewhat useful...