Subject: [Teep] Foreshadow and SGX attestation keys?

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 14 Aug 2018 14:44:16 -0500

Hi all,

You may have seen https://foreshadowattack.eu/#paper making the rounds,
including the remark "[t]he extracted remote attestation keys affect
millions of devices".  While the implementation flaw is of course not fatal
to our goals here, it may have some impact on what level of usability we
can get on what timescale...

-Ben

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 14 Aug 2018 15:52:35 -0400

There have been other research publications in recent months that have also proved SGX is affected by spectre (speculative execution attacks).  They will just keep coming as long as speculative execution is permitted.  The performance gain is hard to ignore.  There are other approaches to enclave separation in research and I’m sure Intel is working on their solutions as well, so hopefully some will chime in.

Thanks for raising this on list.  I look forward to the discussion.

Best,
Kathleen 

Sent from my mobile device

> On Aug 14, 2018, at 3:44 PM, Benjamin Kaduk <[email-masked]> wrote:
> 
> Hi all,
> 
> _______________________________________________
> TEEP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/teep

---

From: Jeremy O'Donoghue <[email-masked]>
Date: Thu, 16 Aug 2018 15:22:26 +0000

There are many possible TEE implementations and architectures. I see no reason why flaws in a particular hardware platform make any difference to the security claims that we can make for a TEE.

While many TEEs are implemented in devices that make use of shared CPU threads, there is nothing preventing a TEE being implemented on a more isolated CPU. The GlobalPlatform TEE System Architecture explicitly allows for a very wide range of possible TEE embodiments, for example.

This class of micro-architectural attack (Spectre and Meltdown being others in a similar vein) is not applicable to designs using a separate CPU. We also know that ARM-based CPUs supporting TrustZone are not vulnerable to Spectre and seem less impacted by Meltdown, for example (it is probably too early to say whether Foreshadow-like techniques are applicable to ARM).

Even for SGX, it seems to me that it is significantly harder to mount a successful attack on a specific identified asset in SGX than it is to obtain elevated privilege on almost any REE.

I do assume that in general, Teep is working towards specifications for a class of execution environments which offer protection from moderately capable attackers who have only software/remote access to a victim device - it is not intended to offer absolute security by a very long way. At best it raises the bar significantly.

Foreshadow is the first such attack on a TEE-like environment I have seen which works from user space and does not require compromise to the kernel, but it will not be the last. Unfortunately the best we can expect is to raise the barrier to attacks.

Best regards
Jeremy

> On 14 Aug 2018, at 20:52, Kathleen Moriarty <[email-masked]> wrote:
>