Re: [PATCH 0/6] Intel Secure Guard Extensions

From: Thomas Gleixner
Date: Fri May 06 2016 - 07:56:10 EST

On Fri, 6 May 2016, Jarkko Sakkinen wrote:

> On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote:
> > It would be helpful and instructive for anyone involved in this debate
> > to review the following URL which details Intel's SGX licening
> > program:
> >
> >
> I think it would be good to note that the licensing process is available
> only for Windows. For Linux you can only use debug enclaves at the
> moment. The default LE has "allow-all" policy for debug enclaves.

Which makes the feature pretty useless.

> > I think the only way forward to make all of this palatable is to
> > embrace something similar to what has been done with Secure Boot. The
> > Root Enclave Key will need to be something which can be reconfigured
> > by the Platform Owner through BIOS/EFI. That model would take Intel
> > off the hook from a security perspective and establish the notion of
> > platform trust to be a bilateral relationship between a service
> > provider and client.
> This concern has been raised many times now. Sadly this did not make
> into Skyle but in future we will have one shot MSRs (can be set only
> once per boot cycle) for defining your own root of trust.

We'll wait for that to happen.