Hacker News Reader

Is there a cheap alternative? I know there are a few vendors selling secure hardware USBs (though how secure I don't know) for various uses, but are there any SoCs to run arbitrary sensitive code without hardware sharing?

View on HN

Intel SGX provides good isolation, it is still vulnerable to some side channel attacks, though it can be mitigated using a TSX hack.

Of course, SGX is not quite available yet on server class CPUs.

Unfortunately, SGX is also vulnerable to timing attacks that leak the private session key, which breaks the enclave security model.

[0] http://www.sharcs-project.eu/m/documents/papers/a02-gotzfrie...

The details aren't completely spelled out here but SGX looks to be an interesting extension of the idea of "virtual machine per block of code" https://software.intel.com/en-us/sgx

It appears a runtime per-site-per-use license is required though.

The latest SDM strongly suggests that some future CPU will change this. Also, certain Linux x86 developers think that SGX support is vastly more likely to be acceptable upstream if this changes :)

There are ways to mitigate such attacks at the operating system level, as explored in the following link?

https://ts.data61.csiro.au/projects/TS/timingchannels.pml

Reply on news.ycombinator.com