Hi! > > Would you list guarantees provided by SGX? > > Obviously, confidentiality and integrity. SGX was designed to address > an Iago threat model, a very difficult challenge to address in > reality. Do you have link on "Iago threat model"? > I don't have the citation immediately available, but a bit-flip attack > has also been described on enclaves. Due to the nature of the > architecture, they tend to crash the enclave so they are more in the > category of a denial-of-service attack, rather then a functional > confidentiality or integrity compromise. So ... even with SGX, host can generate bitflips in the enclave, right? People usually assume that bitflip will lead "only" to denial-of-service, but rowhammer work shows that even "random" bit flips easily lead to priviledge escalation on javascript virtual machines, and in similar way you can get root if you have user and bit flips happen. So... I believe we should assume compromise is possible, not just denial-of-service. > Unfortunately, in the security field it is way more fun, and seemingly > advantageous from a reputational perspective, to break things then to > build solutions.... :-)( Well, yes :-). And I believe someone is going to have fun with SGX ;-). Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Attachment:
signature.asc
Description: Digital signature
