On Fri, 6 May 2016, Jarkko Sakkinen wrote: > On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote: > > It would be helpful and instructive for anyone involved in this debate > > to review the following URL which details Intel's SGX licening > > program: > > > > https://software.intel.com/en-us/articles/intel-sgx-product-licensing > > I think it would be good to note that the licensing process is available > only for Windows. For Linux you can only use debug enclaves at the > moment. The default LE has "allow-all" policy for debug enclaves. Which makes the feature pretty useless. > > I think the only way forward to make all of this palatable is to > > embrace something similar to what has been done with Secure Boot. The > > Root Enclave Key will need to be something which can be reconfigured > > by the Platform Owner through BIOS/EFI. That model would take Intel > > off the hook from a security perspective and establish the notion of > > platform trust to be a bilateral relationship between a service > > provider and client. > > This concern has been raised many times now. Sadly this did not make > into Skyle but in future we will have one shot MSRs (can be set only > once per boot cycle) for defining your own root of trust. We'll wait for that to happen. Thanks, tglx -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
