3 ms·
...and then Intel will simply have their HSM sign the cheat-code firmware for the EPIDs of those six chips. Trust isn't all-or-nothing. When I ride a bus I'm
by crotchfire 3y ago
...and then Intel will simply have their HSM sign the cheat-code firmware for the EPIDs of those six chips.
Trust isn't all-or-nothing. When I ride a bus I'm trusting the driver with my life, but I wouldn't trust them to babysit my kids.
Mutability is deniability. I don't trust hardware companies with that. And I don't have to, either.
Stop hawking this SGX snakeoil. Except maybe to ransomware authors, who deserve what they'll get.
- matthewdgreen 3y agoIntel could presumably help the ransomware authors bypass SGX protections but that’d be dumb. They might have some capability to trace attestations to a specific motherboard but I doubt any sophisticated ransomware group will be foiled by this.
- crotchfire 3y agoI was implying that Intel would help the victims. Attestations are quite certainly traceable to the EPID, which is a fuse array -- it's on the die, not the motherboard. In order to attest, the key that encrypts the victim's data would have to be SGX-generated. What kind of RNG do you think it uses? Maybe Dual_EC_DRDBG?
- Dylan16807 3y agoHelp the victims how? If the CPUs have been captured, there's no need for altered firmware. If the CPUs have not been captured, then how is the altered firmware going to get installed? I suppose it helps them in the former case, if they also had no backups. But the hackers are already in a very bad place if the CPUs get captured, so I don't think they care about SGX at that point. The hackers don't need to trust SGX. They only need the victims to trust it.