Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel deprecates SGX on Core series processors

edc.intel.com

Post reply on HN
Print view View original

121–130 of 138 posts

Re: Intel deprecates SGX on Core series processors

#121

Post by rbanffy »

adgjlsfhk1 wrote: post #108
the8472 wrote: post #105

Earlier quoted context omitted.

It seems silly to do that just due to asymmetric processors. The small cores could simply not support the instructions and the OS could then handle the fault by moving the task to a big core. Perhaps this could be signaled via a different CPU feature flag to avoid libraries using AVX512 instructions sporadically (e.g. in memcopy) and only use it in long-running loops. Or maybe give the OS a way to determine whether t…

even easier would be to have avx 512 be micro coded for the small cores. most of avx512 can be emulated pretty easily.

This. And performance wouldn't be worse than using AVX twice...

But worst case scenario of the OS moving the process to a big core on an illegal instruction or scheduling it to the right core based on a required capabilities system would also be quite acceptable most of the time.

Plus, it'd be great for supporting more specialized cores designed for different purposes and running a single core ISA with extensions for their specific needs. IIRC, there are some ARM chips that have three different kinds of core.

Re: Intel deprecates SGX on Core series processors

#122

Post by grlass »

aaaaaaaaata wrote: post #113
Uptrenda wrote: post #49

Many moons ago, I wrote a prototype on Azure's 'confidential computing' VMs that demonstrated how a computer could 'prove' to another that it was running certain code using 'attestations.' I thought it was cool as hell, and honestly thought that if such a technology held up you could build many interesting things with it. Potentially, it would have had many use-cases in the DeFi industry, privacy-preserving computati…

We can just use phones or USB sticks as signing keys, for anything and everything — why does nobody talk about/want/demand this?!

This is used heavily by hardware tokens like Yubikeys, and especially for cryptocurrency people with so called "hardware wallets" like Trezor and Ledger (which can generate many subkeys on the devices).

Companies like Google now have employees issues with Yubikeys [1].

[1] https://www.yubico.com/resources/reference-customers/google/

Re: Intel deprecates SGX on Core series processors

#123

Post by rbanffy »

ivegotnoaccount wrote: post #72
janwas wrote: post #67

Earlier quoted context omitted.

That's a bold claim. What are your sources? The two latest things I worked on, JPEG XL and quicksort, see a 1.4 and 1.6x speedup from AVX-512. That's on SKX and includes the much-maligned throttling. On a system level, I doubt moving those to GPU is helpful.

Also, moving things to the GPU may be good for throughput but bad for latency depending on the workload, since offloading to GPU has a cost and data exchanges too.

> offloading to GPU has a cost and data exchanges too.

This is bad with dGPUs over the PCIe bus, but not so much with GPUs that share a very fast memory bus with the CPU. In this case, the layout of the data may prove challenging to keep the same for when you use a CPU and a GPU.

Re: Intel deprecates SGX on Core series processors

#124

Post by eightysixfour »

tome wrote: post #66
eightysixfour wrote: post #59

Earlier quoted context omitted.

It is gone now, but IIRC Microsoft was working on a blockchain for inter-enterprise settlement that ran in the secure enclave. It had extremely high throughput and all of the parties could “trust” that the code running was the same, so they were all following the same rules. Neat concept, they killed it before ever sharing source code.

Are you thinking of https://en.m.wikipedia.org/wiki/Confidential_Consortium_Fram... ? It is alive and the source code is shared.

I am! The “Coco” github from back in the day was killed so I thought it was gone.

Re: Intel deprecates SGX on Core series processors

#125

Post by [deleted] »

the8472 wrote: post #105
adrian_b wrote: post #86

Earlier quoted context omitted.

AVX-512 is not supported on the CPUs with "Hybrid Technology", i.e. the current Alder Lake and Raptor Lake, which will be launched towards the end of 2022, to replace Alder Lake. What will happen when the Gracemont small cores will be replaced at the end of 2023, is not known yet. It is still possible that the successor of Gracemont will have AVX-512, in which case the Intel processors with "Hybrid Technology" will a…

It seems silly to do that just due to asymmetric processors. The small cores could simply not support the instructions and the OS could then handle the fault by moving the task to a big core. Perhaps this could be signaled via a different CPU feature flag to avoid libraries using AVX512 instructions sporadically (e.g. in memcopy) and only use it in long-running loops. Or maybe give the OS a way to determine whether t…

[deleted]

Re: Intel deprecates SGX on Core series processors

#126

Post by eightysixfour »

phire wrote: post #98
eightysixfour wrote: post #59

Earlier quoted context omitted.

It is gone now, but IIRC Microsoft was working on a blockchain for inter-enterprise settlement that ran in the secure enclave. It had extremely high throughput and all of the parties could “trust” that the code running was the same, so they were all following the same rules. Neat concept, they killed it before ever sharing source code.

I have seen a deployed altcoin built on SGX. Can't remember the name or if it was even successful. In my opinion, it's a huge risk. With a regular blockchain, the fact that someone might maliciously be running the wrong code is baked into the design, and the security model has to handle it. With SGX, you are relying on Intel's security model to make sure everyone is running the same code. If SGX is ever broken (which…

It wasn’t designed for public blockchains, it was designed for uses in mid-trust environments (“enterprise blockchain”), trading off some level of trust for performance.

Original info: https://azure.microsoft.com/en-us/blog/announcing-microsoft-...

Some of the current outcomes:

https://azure.microsoft.com/en-us/services/azure-confidentia...

https://confidentialcomputing.io/

https://github.com/veracruz-project

Re: Intel deprecates SGX on Core series processors

#127

Post by eightysixfour »

justinclift wrote: post #87
eightysixfour wrote: post #59

Earlier quoted context omitted.

It is gone now, but IIRC Microsoft was working on a blockchain for inter-enterprise settlement that ran in the secure enclave. It had extremely high throughput and all of the parties could “trust” that the code running was the same, so they were all following the same rules. Neat concept, they killed it before ever sharing source code.

> all of the parties could “trust” that the code running was the same Doesn't that trust fall apart when the SGX has known hacks? eg bad actors can do their thing

Yes, but the environment for it was already more “trusted” than public, it was meant for enterprise blockchain.

Re: Intel deprecates SGX on Core series processors

#128

Post by WithinReason »

janwas wrote: post #95
WithinReason wrote: post #76

Earlier quoted context omitted.

If you're processing a lot of data, you're better off moving it to the GPU. If you're processing only a little data, the speed-up doesn't matter. I wonder how wide is the Goldilocks Zone where AVX512 makes a practical difference?

Golly, another sweeping statement :) It seems to me a GPU might actually sort more slowly. For 64-bit keys, we sort about 1 GB/s per (5 year old) Skylake core, and perhaps 5-6 parallel. This (2018) reports 3.5 GB/s: https://benkarsin.files.wordpress.com/2018/10/dissertation.p... And a 6-year old GPU radix sort reports 2.1 GB/s: https://github.com/Bulat-Ziganshin/Compression-Research/tree... BTW I've worked on a produ…

This (2020) reports "Despite the fact that we send the entire data array to the video card and back, sorting on GPU of 800 MB of data is performed about 25-fold faster than on the processor."

https://dev.to/tishden/computing-with-gpu-why-when-how-and-s...

This shows a approximately 20x speedup (2021, graph 1 vs 3): https://www.irjet.net/archives/V8/i7/IRJET-V8I7714.pdf

Re: Intel deprecates SGX on Core series processors

#129

Post by mike_hearn »

betterunix2 wrote: post #118
mike_hearn wrote: post #92

Earlier quoted context omitted.

You trust the security of your CPU vendor in all cases. SGX doesn't change that. If Intel wanted to, they could release a microcode update that detects a particular code sequence running and then patches it on the fly to create a back door. You'd never even know. "SGX as a concept for tenant-provider isolation requires strong local attacker security, which is something off the shelf x86 has never had" Off the shelf C…

"SGX is hard because it's trying to preserve the open nature of the platform" Except that was an afterthought. Originally only whitelisted developers were allowed to use SGX at all, back when DRM was the only use-case they had in mind.

It clearly wasn't an afterthought, I don't think anyone familiar with the design could possibly say that. It's intended to allow any arbitrary OS to use it, and in fact support on Linux has always been better than on Windows, largely because Intel could and did implement support for themselves. It pays a heavy price for this compared with the simpler and more obvious (and older) chain-of-trust approach that games consoles and phones use.

The whitelisting was annoying but gone now. The justification was (iirc) a mix of commercial imperatives and fear that people would use it to make un-reversable ransomware/malware. SGX was never really a great fit for copy protection because content vendors weren't willing to sell their content only to people with the latest Intel CPUs.

Re: Intel deprecates SGX on Core series processors

#130

Post by stuu99 »

userbinator wrote: post #45

Is the ME next? One can dream... that Intel will stop playing with all of this user-hostile "security" nonsense and focus on performance and power efficiency while also releasing all the detailed programming/design information publicly.

They aren't going to.

The industry has been pushing for copyright enforcement built into the hardware and OS. Windows 10/11 is the first client-server OS, aka the ultimate security risk since you all have been stealing software from yourselves with the rise of mmo's and steam, there's ZERO reason for any piece of software to require an internet connection.

Intel, MS, Sony and AMD are not going to give up on trusted computing. They want to remove control of our PC's to jack up software prices and force the public to pay for software and games.

https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

Post reply on HN