6 ms·
Intel SGX Fuse Key0, a.k.a. Root Provisioning Key Was Extracted by Researchers
- tiagod 2y ago[flagged]
- irundebian 2y agoWhich step?
- baybal2 2y ago[dead]
- deleted 2y ago[deleted]
- kzrdude 2y agoWhat's the impact of this?
- RockRobotRock 2y agoMay help break DRM? But not sure
- ronsor 2y agoPC Blu-ray players all require SGX. Now that's permanently broken.
- lxgr 2y agoApparently that's been on the way out for a while now: https://news.ycombinator.com/item?id=32442894 https://news.ycombinator.com/item?id=32442894 Now I'm curious, thouyh: Have there really never been any software Blu-ray players supporting AMD?
- toast0 2y agoBlu-ray is fine, it's Ultra Blu-Ray (aka Blu-Ray 4k) that needs SGX for officially licensed playback. No AMD support there. But non licensed play back is fine.
- brokenmachine 2y agoI think it was already broken? 37C3 - Full AACSess: Exposing and Exploiting AACSv2 Uhd Drm for Your Viewing Pleasure https://www.youtube.com/watch?v=SEBuiecLZGg https://www.youtube.com/watch?v=SEBuiecLZGg
- gojomo 2y agoSome of Signal's designs for contact privacy, including in the new usernames feature, rely on trust in SGX. If anyone (including Signal) can pretend to be a secure SGX environment, you're back to trusting Signal's personnel/operations, rather than Intel/SGX, for some of the metadata/contact privacy they've historically touted. More info (2020): https://medium.com/@maniacbolts/signal-increases-their-reliance-on-sgx-f46378f336d3 https://medium.com/@maniacbolts/signal-increases-their-relia...
- eklitzke 2y agoJust to expand on this, since it wasn't originally clear to me from reading your post, the contact privacy feature is about using SGX enclaves for the purpose of populating your known contacts on Signal. When you log into Signal for the first time your phone locally has all of your known contacts, and the Signal app wants to know which of these contacts already have Signal accounts. The secure enclave is a mechanism where you publish your entire contact list from your phone to the Signal servers, then they can send back the subset of those contacts that actually have Signal accounts. The point of the enclave is that this is all done in a way where Signal can't see what contacts you sent them, nor can they determine which contacts were matched and sent back to you.
- ein0p 2y ago[flagged]
- anaisbetts 2y ago[flagged]
- inhumantsar 2y agoit's used quite a bit in finance for things like transaction signing. the keys used to create signatures only ever exist within the SGX enclave, similar to how yubikeys and HSMs do the same thing. compromising SGX wouldn't suddenly open up all of these transactions to exploitation though, since the attacker would need (presumably root) access to the machine and the keys could always be rolled. I'm no expert but I suspect it would mean urgent firmware updates for anyone relying on SGX
- chc4 2y agoI'm under the impression enclave keys have been extracted before, and Intel was able to mitigate by essentially publishing a key revocation update that made models with the extracted keys not be trusted for remote attestation. Is that also the case with these keys?
- fallingsquirrel 2y agoThat doesn't solve the greater issue. Let's say you bought an Intel CPU because your company requires remote attestation. Then a researcher publishes an exploit. Then Intel pushes an update that revokes keys from your model of CPU. What would you do, go happily spend $500 on a new one? Should we landfill millions of CPUs everytime the mouse pulls ahead of the cat?
- Mindwipe 2y agoThis is pretty common FWIW. Google revokes attestation keys for Android hardware a lot, especially Widevine Level 1 keys. Ten years into that, the public doesn't seem very excised about it.
- throwaway2037 2y agoI disagree. This seems like fantasy. First, I don't think Intel has even done this -- "pushes an update that revokes keys from your model of CPU". If they did, there would be an enormous class action lawsuit. Remember that most CPUs are bought by large corporations, with extremely deep pockets. Even if Intel were to miraculously win the case, surely their reputation would irreparably harmed.
- hsbauauvhabzb 2y agoIf that were the case, spectre, meltdown and similar vulnerabilities would surely have similar class actions?
- dogma1138 2y agoIIRC this is the first time a fused key was leaked; keys were leaked before but those were firmware keys which were encrypted with the root fused key which as it’s name suggests is literally fused into the silicon through programmable fuses. It’s unclear if Intel has enough fuses to push a new key and if there is a mechanism to do it in software without a specialized programming station. If the latter two are possible and they can fix the leak vector with a ucode update then they can likely revoke the key and patch this over.
- bananapub 2y agothis is obviously entertaining, but the entire history of SGX is just getting owned over and over and over: https://en.wikipedia.org/wiki/Software_Guard_Extensions#List_of_SGX_vulnerabilities https://en.wikipedia.org/wiki/Software_Guard_Extensions#List...
- thot_experiment 2y agoGreat! Always gives me a little more hope for computing when these sorts of things are compromised, I know at some point in the future I'll be able to break/reverse some annoying piece of proprietary garbage because of this and I'm grateful. Each security barrier compromised is one less thing I have to deal with trying to run my software on my computers. I only have one life to live and I don't want to spend it fighting onerous security restrictions. (how many minutes have i lost waiting for 2FA or figuring out how to run unsigned drivers) I vastly prefer the world where the king of my computer is me and maybe also some hackers vs the one where it's Intel/Apple etc.
- userbinator 2y agoInsecurity is freedom, as usual. Intel already angered tons of enthusiasts who have no use for SGX by releasing a microcode update to lock out undervolting, due to that one exploit that relied on undervolting. Now everyone suffers from increased heat and power usage to protect against something they never needed protection from.
- iforgotpassword 2y ago> Now everyone suffers from increased heat and power usage Why? And wasn't sgx removed from newer cpus anyways? At least in desktop/mobile space...
- taskforcegemini 2y ago>Why? because undervolting usually results in lower power draw/higher power efficiency
- iforgotpassword 2y agoBut they said "everyone" - I imagine undervolting would only be done by people trying to hack the sgx, or maybe try to save a bit of power. So I'd assume 99.99% of users would be unaffected? Or did the cpu undervolt automatically before the update?
- miki123211 2y agoFor people who feel happy about this because "DRM bad, piracy good, capitalism evil", this is actually more complicated than it seems. Yes, features like this can be used by corporations to enforce DRM and ensure that you aren't running unapproved or modified versions of their code. However, this works both ways, because it can also be used by customers to make sure that corporations are actually running the code they're claiming to be running, and that's pretty useful. Signal is a prominent example of this. There is no way to securely implement a way to find people by their phone number without a solution like SGX. You can either remove the feature completely, making your app hard to use and making users more likely to choose closed-source solutions, or you can implement it insecurely, becoming susceptible to hackers and law enforcement actions. With SGX, users can just verify that the code you're running does not, in fact, send all their data to the NSA behind their backs.
- ssklash 2y agoThe difference in number of situations where it's a corporation enforcing their will on you vs. you being able to trust them is massive. If Signal had used a different method then I don't think there would be a single example of "customers to make sure that corporations are actually running the code they're claiming to be running".
- striking 2y agoHere's a comment from some number of years ago suggesting an implementation of private set intersection for Signal's phone number / contact search without the use of SGX: https://news.ycombinator.com/item?id=11289223 https://news.ycombinator.com/item?id=11289223
- yjftsjthsd-h 2y ago> it can also be used by customers to make sure that corporations are actually running the code they're claiming to be running, and that's pretty useful. Has any company beyond Signal ever done this? Ever?
- HeatrayEnjoyer 2y agoDual authentication is common in the defense space.
- motohagiography 2y agothe failure mode of having a single provisioning key instead of limited batch keys derived from ones in an HSM creates the incentive where this is inevitable. if one key gets you all chips, then someone is going to get that because the payout is total dominion. I've seen this trade off in similar protocols, and every time it's like "thanks for the advice, we're going to go with just the one, it's easier." There is one OEM/protocol I suspect actually uses diversified batch keys as their root provisioning secret, and really it's the way to go if you do business globally now. What's more interesting is what the consequences will be, as if there are none (it's not like the stock will hurt) then the market is saying crypto can be sabotaged with impunity.
- anonymousDan 2y agoIs there a trade-off wrt attestation privacy here - i.e. using a single root key is better for privacy?
- hedora 2y agoIdeally, at least for headless server hardware, if you have physical access, you could wipe the provisioning key and replace it with your own. Doing so should blow away the disk keys, etc. I’ve always assumed systems that relied on a key and didn’t support that were backdoored.
- fragmede 2y agoWhich systems support that?
- motohagiography 2y agowith batch sizes in the millions less so, but agreed it's still a differentiating attribute. I would solve that higher up in the protocols that used it, as the initialization keys shouldn't be related to post-provisioning keys in a way that is verifiable to anyone except the OEM, again arguable, but it's a higher level protocol question imo.
- 2y ago
- userbinator 2y agoNot surprised at all to see where the researcher is from. I've noticed people from Eastern Bloc countries tend to have a certain mindset and skills that leads to being able to do such things.
- 486sx33 2y agoBecause they managed to survive the communists and not get killed by Stalin
- ethbr1 2y agoOr because their math education system was excellent and broadly accessible.
- sterlind 2y agoprobably also because of piracy and the cracking scene. you're too poor to buy software, so you learn to crack it. you learn how to read assembly and use a debugger, a ton of obfuscation techniques and how to circumvent them, cryptanalysis through writing keygens. I'm not from the Eastern Bloc but I picked up some serious reverse engineering skills as a teenager from the warez scene.
- StillBored 2y agoSame here couple decades ago, but along with that being poor also limits your alternative forms of entertainment as well as access to the latest high performance HW. Which leads to both the boredom required to think that sitting in front of ones computer for days on end hacking as well as the motivation to figure our how to hack some game to run slightly better. I freqently think that my parents best parenting choice was the choice to not have a TV in our house when I was growing up. It both saved them money but removed a very common time wasting/entertainment outlet. My own kids went from playing with legos, creating art, or messing with science kits to playing on their phones as soon as they were given that choice. And i'm still of the opinion that providing that choice was a big mistake, they are experts on the latest social media fad, and quite ignorant about things I wish they would have learned. So, yes enviroment matters, some kids will hack even when given an xbox and a pile of games, but I think more of them will try it if they aren't given those choices.
- anonymousDan 2y agoAre there any details on the attack? Does it require physical access in any way?
- yukIttEft 2y agoI thought microcode was encrypted, how do they have its disasm? https://xcancel.com/pic/orig/media%2FGV7BLfeXsAEJ6HC.png https://xcancel.com/pic/orig/media%2FGV7BLfeXsAEJ6HC.png