What's Intel SGX Good For?
lightbluetouchpaper.org
What's Intel SGX Good For?
1–10 of 60 posts
Re: What's Intel SGX Good For?
#2So the security of a blockchain now depends on the security of the SGX enclave? What could possibly go wrong...
> Unfortunately, this proposal suffers from a critical security economics issue: node maintainers here have a strong incentive to break into their own SGX chips. If an adversary managed to compromise their SGX, they could win the leader election at every round by setting the timeout to 0. The more valuable the network, the stronger the incentive to compromise your own platform.
I wouldn't call controlling my own SGX "compromising my own platform". It is my own platform after all, why should I not control it as I please?
Re: What's Intel SGX Good For?
#3TL;DR: same as ARM's Trustzone ... brilliant for hiding malware.
Re: What's Intel SGX Good For?
#4TL;DR: same as ARM's Trustzone ... brilliant for hiding malware.
"SGX differs from its competitors such as TrustZone in its focus on reducing the volume of trusted code in its “secure world”."
Re: What's Intel SGX Good For?
#5TL;DR: same as ARM's Trustzone ... brilliant for hiding malware.
"SGX differs from its competitors such as TrustZone in its focus on reducing the volume of trusted code in its “secure world”."
The fact that it's designed to allow a smaller volume of trusted code doesn't really prevent you from putting the "normal" amount of malware in there...
Re: What's Intel SGX Good For?
#6So the security of a blockchain now depends on the security of the SGX enclave? What could possibly go wrong... > Unfortunately, this proposal suffers from a critical security economics issue: node maintainers here have a strong incentive to break into their own SGX chips. If an adversary managed to compromise their SGX, they could win the leader election at every round by setting the timeout to 0. The more valuable…
It's not "your own platform", that's what the article gets wrong. The entire purpose of SGX is that it's my platform (that I can control/be assured that you can't), running on your hardware.
Re: What's Intel SGX Good For?
#7So the security of a blockchain now depends on the security of the SGX enclave? What could possibly go wrong... > Unfortunately, this proposal suffers from a critical security economics issue: node maintainers here have a strong incentive to break into their own SGX chips. If an adversary managed to compromise their SGX, they could win the leader election at every round by setting the timeout to 0. The more valuable…
Yeah, you can only use SGX-like systems when the reward from breaking them is limited since they can all be broken given sufficient resources (or even just insider knowledge).
For example, it might be fine as a way to guarantee the integrity of things like Folding@Home where disruption provides no gain other than the satisfaction of successful vandalism, but not for securing a popular cryptocurrency.
Re: What's Intel SGX Good For?
#8From a paper in that article:
"Intel has recently added support for monotonic counters [5] as an optional SGX feature that an enclave developer may use for rollback attack pro- tection, when available. However, the security and per- formance properties of this mechanism are not precisely documented. We performed a detailed analysis of SGX counters and report our findings in Appendix B. To summarize, we found out that counter updates take 80-250 ms and reads 60-140 ms. The non-volatile mem- ory used to implement the counter wears out after ap- proximately one million writes, making the counter func- tionality unusable after a couple of days of continuous use. Thus, SGX counters are unsuitable for systems where state updates are frequent and continuous."
permanently breaks lol
Re: What's Intel SGX Good For?
#9Hypothetical, but would intel be better off trying to allocate one of its 70 cores as a dedicated crypto processor with dedicated memory rather than fall down the trap of trying to safely share resources?
Re: What's Intel SGX Good For?
#10Perhaps I'm just missing the point here, but what's a "permissioned blockchain" and how does it differ from a plain old database?