Hacker News Reader

Apple's secure enclave docs also mention memory encryption. The PCC blogpost mentions that the server hardware is built on secure enclaves. And since they are claiming that even Apple can't access it, I am currently assuming that there will be memory encryption happening on the servers. At which point you have have the main ingredients of CC: memory encryption & remote attestation.

EDIT: and they mention SGX and Nitro. Other CC technologies :)

View on HN

> Apple's secure enclave docs also mention memory encryption.

Yes, but that's only within the enclave. Every Mac hardware since T2 has had that, and we don't consider them strong enough to meet the CC bar.

As an example of the difference, CC is designed so that a compromised hypervisor cannot inspect your guest workload. Whereas in Apple's design, they attempt to prove that the hypervisor isn't compromised. Now imagine there's a bug ...

(Not that SGX hasn't had exploitable hardware flaws, but there is a difference here.)

Reply on news.ycombinator.com