Intel SGX Fuse Key0, a.k.a. Root Provisioning Key Was Extracted by Researchers

https://twitter.com/_markel___/status/1828112469010596347

by tiagod • 2 years ago

234 61 2 years ago

twitter.com

kzrdude• 2 years ago

What's the impact of this?

RockRobotRock• 2 years ago

May help break DRM? But not sure

ronsor• 2 years ago

PC Blu-ray players all require SGX. Now that's permanently broken.

gojomo• 2 years ago

Some of Signal's designs for contact privacy, including in the new usernames feature, rely on trust in SGX.

If anyone (including Signal) can pretend to be a secure SGX environment, you're back to trusting Signal's personnel/operations, rather than Intel/SGX, for some of the metadata/contact privacy they've historically touted.

More info (2020): https://medium.com/@maniacbolts/signal-increases-their-relia...

eklitzke• 2 years ago

Just to expand on this, since it wasn't originally clear to me from reading your post, the contact privacy feature is about using SGX enclaves for the purpose of populating your known contacts on Signal. When you log into Signal for the first time your phone locally has all of your known contacts, and the Signal app wants to know which of these contacts already have Signal accounts. The secure enclave is a mechanism where you publish your entire contact list from your phone to the Signal servers, then they can send back the subset of those contacts that actually have Signal accounts. The point of the enclave is that this is all done in a way where Signal can't see what contacts you sent them, nor can they determine which contacts were matched and sent back to you.

inhumantsar• 2 years ago

it's used quite a bit in finance for things like transaction signing. the keys used to create signatures only ever exist within the SGX enclave, similar to how yubikeys and HSMs do the same thing.

compromising SGX wouldn't suddenly open up all of these transactions to exploitation though, since the attacker would need (presumably root) access to the machine and the keys could always be rolled.

I'm no expert but I suspect it would mean urgent firmware updates for anyone relying on SGX

chc4• 2 years ago

I'm under the impression enclave keys have been extracted before, and Intel was able to mitigate by essentially publishing a key revocation update that made models with the extracted keys not be trusted for remote attestation. Is that also the case with these keys?

fallingsquirrel• 2 years ago

That doesn't solve the greater issue. Let's say you bought an Intel CPU because your company requires remote attestation. Then a researcher publishes an exploit. Then Intel pushes an update that revokes keys from your model of CPU. What would you do, go happily spend $500 on a new one? Should we landfill millions of CPUs everytime the mouse pulls ahead of the cat?

throwaway2037• 2 years ago

I disagree. This seems like fantasy. First, I don't think Intel has even done this -- "pushes an update that revokes keys from your model of CPU". If they did, there would be an enormous class action lawsuit. Remember that most CPUs are bought by large corporations, with extremely deep pockets. Even if Intel were to miraculously win the case, surely their reputation would irreparably harmed.

Mindwipe• 2 years ago

This is pretty common FWIW.

Google revokes attestation keys for Android hardware a lot, especially Widevine Level 1 keys.

Ten years into that, the public doesn't seem very excised about it.

dogma1138• 2 years ago

IIRC this is the first time a fused key was leaked; keys were leaked before but those were firmware keys which were encrypted with the root fused key which as it’s name suggests is literally fused into the silicon through programmable fuses.

It’s unclear if Intel has enough fuses to push a new key and if there is a mechanism to do it in software without a specialized programming station.

If the latter two are possible and they can fix the leak vector with a ucode update then they can likely revoke the key and patch this over.

bananapub• 2 years ago

this is obviously entertaining, but the entire history of SGX is just getting owned over and over and over: https://en.wikipedia.org/wiki/Software_Guard_Extensions#List...

thot_experiment2• 2 years ago

Great! Always gives me a little more hope for computing when these sorts of things are compromised, I know at some point in the future I'll be able to break/reverse some annoying piece of proprietary garbage because of this and I'm grateful. Each security barrier compromised is one less thing I have to deal with trying to run my software on my computers. I only have one life to live and I don't want to spend it fighting onerous security restrictions. (how many minutes have i lost waiting for 2FA or figuring out how to run unsigned drivers) I vastly prefer the world where the king of my computer is me and maybe also some hackers vs the one where it's Intel/Apple etc.

userbinator2• 2 years ago

Insecurity is freedom, as usual.

Intel already angered tons of enthusiasts who have no use for SGX by releasing a microcode update to lock out undervolting, due to that one exploit that relied on undervolting. Now everyone suffers from increased heat and power usage to protect against something they never needed protection from.

iforgotpassword2• 2 years ago

Now everyone suffers from increased heat and power usage

Why?

And wasn't sgx removed from newer cpus anyways? At least in desktop/mobile space...

heavyset_go• 2 years ago

Interesting how "security" these days almost always means securing corporations' bottom lines.

kps• 2 years ago

These days?

Intel, 1999: “The actual user of the PC — someone who can do anything they want — is the enemy.”

https://www.zdnet.com/article/the-biggest-security-threat-yo...

miki123211• 2 years ago

For people who feel happy about this because "DRM bad, piracy good, capitalism evil", this is actually more complicated than it seems.

Yes, features like this can be used by corporations to enforce DRM and ensure that you aren't running unapproved or modified versions of their code. However, this works both ways, because it can also be used by customers to make sure that corporations are actually running the code they're claiming to be running, and that's pretty useful.

Signal is a prominent example of this. There is no way to securely implement a way to find people by their phone number without a solution like SGX. You can either remove the feature completely, making your app hard to use and making users more likely to choose closed-source solutions, or you can implement it insecurely, becoming susceptible to hackers and law enforcement actions. With SGX, users can just verify that the code you're running does not, in fact, send all their data to the NSA behind their backs.

ssklash• 2 years ago

The difference in number of situations where it's a corporation enforcing their will on you vs. you being able to trust them is massive. If Signal had used a different method then I don't think there would be a single example of "customers to make sure that corporations are actually running the code they're claiming to be running".

striking• 2 years ago

Here's a comment from some number of years ago suggesting an implementation of private set intersection for Signal's phone number / contact search without the use of SGX: https://news.ycombinator.com/item?id=11289223

yjftsjthsd-h• 2 years ago

it can also be used by customers to make sure that corporations are actually running the code they're claiming to be running, and that's pretty useful.

Has any company beyond Signal ever done this? Ever?

HeatrayEnjoyer• 2 years ago

Dual authentication is common in the defense space.

tveita2• 2 years ago

Apple is leaning into this for cloud AI: https://security.apple.com/blog/private-cloud-compute/

Probably enough to be genuinely hard for an APT to backdoor even with insider help. Still, ultimately the security relies on Apple hardware signed with Apple keys.

akira2501• 2 years ago

With SGX, users can just verify that the code you're running does not, in fact, send all their data to the NSA behind their backs.

I'm genuinely unclear. How exactly does a user accomplish this? What role does SGX play in this?

TomatoCo• 2 years ago

Obviously the remote code could send the data to whatever three letter agency the operator wants, so the remote operator need to publish the server's code. But how do you prove that the remote operator is running the code they claim they are?

That's what SGX does, it lets remote systems provide a cryptographic proof that they are running certain code. Including the ability to have a private key protected by the SGX, so you can public key encrypt your data, send it to the remote server, and know that only the code they've already published is processing your data.

schoen• 2 years ago

The theory is that when you send your contact list to the service, the service can prove to you that it's running a specified set-intersection application (and nothing else!) in the environment that will have access to that data, using this attestation mechanism.

If it modified the application to make it log or leak your data somehow, it could no longer pass that attestation step.

This should work as long as there is no hardware or side channel attack that lets the service operator (or someone it rents hardware from) defeat the SGX security guarantees, as long as there's no backdoor in the enclave implementation, and as long as the signing keys are not leaked or extracted, and are only used in accordance with the published policies.

soraminazuki• 2 years ago

With SGX, users can just verify that the code you're running does not, in fact, send all their data to the NSA behind their backs

This is a big claim which needs extraordinary proof if we're going to rely on that assumption for security. Remember, we're talking about an organization that did things like sneak in backdoors in encryption standards or infiltrate Google's internal network to passively extract user data en masse. We should just assume the NSA has gotten the keys from Intel a long time ago, voluntarily or not.

The NSA doesn't respect the rules. Nor do they think about the wider consequences of their actions. They're a reckless and irresponsible organization with an enormous budget. If they want something from Intel, they will have it.

hedora2• 2 years ago

There are firms that sell phone scanning utilities that pull signal message off (unlocked?) ios and android (and presumably desktops).

Even if signal used an enclave key to encrypt the local chat database, sgx doesn’t protect the enclave from the keyboard, mouse or display drivers, so someone could simply write a screen scraper that displayed and captured each message of each thread.

grishka2• 2 years ago

However, this works both ways, because it can also be used by customers to make sure that corporations are actually running the code they're claiming to be running, and that's pretty useful.

This still requires trusting Intel.

tveita2• 2 years ago

Signal users should be happy about this, because it exposes the SGX enclaves as the false security it is. It's not like this is the first SGX exploit.

You should assume that Signal engineers, if they chose to, could access the user data protected by SGX, just like they could log metadata about your message sending and receiving patterns. You only have their word that they don't. The NSA could certainly bypass the SGX given access to the server.

I suppose there may be some legal benefit in putting the data "out of reach" - it would be hard to prove in court that you were capable of leveraging an exploit towards SGX to provide the requested data. But NSA/others will happily take possession of the hardware and do it themselves.

motohagiography2• 2 years ago

the failure mode of having a single provisioning key instead of limited batch keys derived from ones in an HSM creates the incentive where this is inevitable.

if one key gets you all chips, then someone is going to get that because the payout is total dominion. I've seen this trade off in similar protocols, and every time it's like "thanks for the advice, we're going to go with just the one, it's easier." There is one OEM/protocol I suspect actually uses diversified batch keys as their root provisioning secret, and really it's the way to go if you do business globally now.

What's more interesting is what the consequences will be, as if there are none (it's not like the stock will hurt) then the market is saying crypto can be sabotaged with impunity.

anonymousDan2• 2 years ago

Is there a trade-off wrt attestation privacy here - i.e. using a single root key is better for privacy?

hedora2• 2 years ago

Ideally, at least for headless server hardware, if you have physical access, you could wipe the provisioning key and replace it with your own.

Doing so should blow away the disk keys, etc.

I’ve always assumed systems that relied on a key and didn’t support that were backdoored.

motohagiography2• 2 years ago

with batch sizes in the millions less so, but agreed it's still a differentiating attribute. I would solve that higher up in the protocols that used it, as the initialization keys shouldn't be related to post-provisioning keys in a way that is verifiable to anyone except the OEM, again arguable, but it's a higher level protocol question imo.

paulmd• 2 years ago

There is one OEM/protocol I suspect actually uses diversified batch keys as their root provisioning secret, and really it's the way to go if you do business globally now.

seems like apple, since it’s actually an important factor to them and not just to third parties?

userbinator2• 2 years ago

Not surprised at all to see where the researcher is from. I've noticed people from Eastern Bloc countries tend to have a certain mindset and skills that leads to being able to do such things.

486sx33• 2 years ago

Because they managed to survive the communists and not get killed by Stalin

ethbr1• 2 years ago

Or because their math education system was excellent and broadly accessible.

weinzierl• 2 years ago

Because they can be content and get by with what they've got without wasting time complaining. Also the mindset that there is no difference between use and misuse - intended purpose is meaningless, creative reuse is a virtue.

RicoElectrico• 2 years ago

This ethos should be standard everywhere.

anonymousDan2• 2 years ago

Are there any details on the attack? Does it require physical access in any way?

yukIttEft• 2 years ago

I thought microcode was encrypted, how do they have its disasm? https://xcancel.com/pic/orig/media%2FGV7BLfeXsAEJ6HC.png

skissane• 2 years ago

See https://github.com/chip-red-pill/uCodeDisasm

ale42• 2 years ago

See for example https://github.com/chip-red-pill/MicrocodeDecryptor

Intel SGX Fuse Key0, a.k.a. Root Provisioning Key Was Extracted by Researchers

Related Stories