[messaging] Encrypted Pulic Contact Discovery

[Justin King-Lacroix]

SGX has another advantage: the root SGX certificates are issued by Intel,
rather than TPM manufacturers and OEMs... which means they'll actually
exist.

Seriously. This was the biggest problem with using remote attestation on
the open Internet: TPM manufacturers have only recently started issuing
endorsement certificates, and I still don't know if Dell/HP/etc issue
platform certificates to go with.




On 26 August 2015 at 09:51, Ben Laurie <ben at links.org> wrote:

>
>
> On Sun, 23 Aug 2015 at 14:34 Mike Hearn <mike at plan99.net> wrote:
>
>> Useful article Moxie, thanks.
>>
>> There is a way to do practical PIR for the contacts use case, although
>> nobody here will like it much.
>>
>> You use the new SGX features in the Intel Skylake+ processors to create a
>> trusted computing "enclave" that generates some encryption keys. Then your
>> other servers do the same, and remotely attest to the first what software
>> they're running. The first then gives them copies of the keys as well. Now
>> you have a server farm with encryption keys you don't yourself know, and
>> cannot extract without impractical time and expertise spend breaking the
>> hardware security on the x86 chips.
>>
>> This isn't as good as mathematically unbreakable security that relies on
>> heat-death-of-the-universe type arguments, but it's in practice nearly as
>> good, and would actually be deployable.
>>
>
> Heh. If anyone had managed to make remote attestation work, that is. That
> said, it seems like SGX makes it more possible than previous attempts,
> since (in theory) you only need to attest to the enclave contents. Not 100%
> sure I believe that yet, though.
>
>
> _______________________________________________
> Messaging mailing list
> Messaging at moderncrypto.org
> https://moderncrypto.org/mailman/listinfo/messaging
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/messaging/attachments/20150826/c29149db/attachment.html>