SGX Secure Enclaves in Practice: Security and Crypto Review
summary
Hands-on assessment uses real Skylake hardware and both Intel Windows SDK (requires Visual Studio Professional 2012) and the new Linux SDK from GitHub, inspects ~170,000 lines of SDK and platform binaries, and documents which features live in microcode versus platform software. Finds EPID group signatures, hybrid quote construction (RSA-encrypted ephemeral AES key + AES-GCM), RDSEED/RDRAND for entropy, AES-GCM/CMAC and P‑256 ECDSA/ECDH, and Intel IPP crypto. Builds a working re-encryption proxy prototype and a metadata extractor to parse seal blobs and quotes; demo runs but is not production hardened.
AI-written summary · about
chapters (37)
- 0:00Introduction
- 0:45SGX
- 1:44SGX Overview
- 5:01Cloud Computing
- 5:35DRM
- 6:08Reverse Engineer
- 8:02Trust Computing Base
- 10:15Security Limitations
- 12:16Bugs
- 13:35Setup
- 14:09Linux SDK
- 14:33Warning
- 15:20What you get
- 16:34SDK
- 16:55Whats in the SDK
- 18:11Debugging
- 18:49Developer Key
- 20:14Partitioning
- 21:20Limitations
- 21:59Sealing
- 23:17Remote attestation
- 24:32Disclaimer
- 25:38Crypto
- 27:35Crypto SDK
- 28:32Where does it come from
- 29:02Linux Source Code
- 30:03AES
- 31:46Randomness
- 33:20Be careful
- 33:36Canaan CLAV
- 35:21How secure is it
- 36:32PIDs
- 38:41Applications
- 39:15Encryption Proxy
- 43:34Metadata
- 44:31Demo
- 46:26Conclusion
related talks
54mWhen Good Turns Evil: Using Intel SGX to Stealthily Steal Bitcoins
38mOne Ring -3 To Secure Them All: Computing with Hardware Enclaves
35mBringing Intel SGX to the Rust Ecosystem
53mBehind the Scenes of Intel Security and Manageability Engine
46mState of Intel SGX in Linux
41mBoF: The Open Enclave SDK: Confidential Computing with Trusted Apps
36mAttacking & Defending Kubernetes TEE Enclaves in Critical Infrastructure
41mPanel: A New Root Of Trust: Changing Computing With TEE