UC Berkeley to build open-source secure enclave using RISC-V • Hacker News Board

Re: UC Berkeley to build open-source secure enclave using RISC-V

#51

Post by lclarkmichalek » Fri, Dec 14, 2018, 10:00 PM UTC

excalibur wrote: post #44

lclarkmichalek wrote: post #39

Earlier quoted context omitted.

You might/should rotate the leaf keys regularly, but root keys are a massive pain to rotate (when you change a root key, you need to reprovision the corresponding cert onto every machine, as they're the root of trust for your PKI). You can buy a new HSM every 3 years to rotate those root keys, which fits fairly well into most organisation's decommissioning cycles.

Root keys are more of a pain to swap out, but AD does a pretty good job of handling the grunt work of distributing them across the organization. And the leaf keys should live on HSMs as well. You might be able to get by with a hardcoded root key if you're willing to accept the tradeoff, but that situation isn't going to work for the rest.

AD and similar things def help, but it's still hard, especially once your deployment gets big or complicated - at the last place I worked we had tons of linux hosts + google cloud load balancers + aws load balancers + a tiny AD domain + various others. I think once you hit a certain size, it's incredibly hard to keep homogeneity.

Leaf keys on HSMs is interesting. Personally, I view HSM and TPM stored keys about having an immutable identity for the device. Leaf keys are usually a bit more complicated - in the environments I work in, leaf keys are often tied to a service, not the host. The short lived nature also reduces the impact of ex-filtration.

Anyway, yeah, depends on the deployment and the org.

Re: UC Berkeley to build open-source secure enclave using RISC-V

#52

Post by jiveturkey » Sat, Dec 15, 2018, 12:16 AM UTC

laburn wrote: post #50

I don't understand how this differentiates itself from ARM TrustZone. You can already create a system with a dedicated HSM and run your own trusted operating system using the features of the processor. With Intel SGX you are somewhat stuck with using the HSM provided by Intel. With the BSD-licensing aren't we left in the same place as ARM processors, with the exception of producing a RISC-V processor being less expen…

Is TrustZone open source? It's in TFA, the differentiator is that this is open source. Enclaves per se have existed for a long time now.

Re: UC Berkeley to build open-source secure enclave using RISC-V

#53

Post by jiveturkey » Sat, Dec 15, 2018, 12:17 AM UTC

TickleSteve wrote: post #15

Hardware Security Modules (HSMs) are in plentiful supply, they're not new and the OP seems to have swallowed a bit of the Apple KoolAid from the description of the M7 being 'revolutionary'. This is simply another HSM implementation, and no, they don't stop hackers, there are plenty other exploits to go for. (For one example h https://www.nxp.com/products/identification-and-security/sec... )

this is a far cry from an HSM. an HSM provides much better protection than an enclave, but it can do much less.

Re: UC Berkeley to build open-source secure enclave using RISC-V

#54

Post by andromeduck » Sat, Dec 15, 2018, 8:43 AM UTC

na85 wrote: post #43

jchw wrote: post #18

Cool. HSMs are a notable step up from secure execution environments like TrustZone and SGX because they make side-channel attacks that take advantage of the shared hardware much more difficult. That said, the HSM itself becomes a target after a while. So the more stuff you off-load to your enclave, the larger the attack surface becomes, and now you moved your problem over. And I am further skeptical about how much th…

>But in a world where there are known, novel attacks against the integrity of microchips that would make it difficult to verify even in the presence of microscope images of a decapped chip, I'm not sure if this really gives us that much reassurance that the chip does what it says I find myself saying this a lot lately but I really think that stuff like this is going to lead us to chip fabs being national strategic in…

When were fabs not a strategic asset?! It's the whole reason Taiwan still exists.