and the entertainment business, it also includes SGX and its "secure cloud computing" scheme.

One might have a discussion on that and I even might agree to a large degree - but SGX is a decisive security device for many, it's about the best they have/had for some secure volatile storage.

SGX is a rubbish to begin with. It's a glorified DRM at best.

Answer: Look at why KASLR was developed and deployed. Also read OP again (hint: e.g. SGX).

* The attack also works in restricted environments such as SGX

(Quote)

Yes, AMD Epyc is more secure for servers than intels SGX. Does that mean intel is all but dead ("Game over")? I have doubts.

Intels SGX addresses mostly the first one and to a small degree the second one. AMD clearly addresses the third one - which is the context we care about here.

Sounds like it is because SGX is supposed to prevent exposing data in exactly this scenario (where another app has root privilege). Some kind of hardware-level isolation according to the zdnet article

If you really have super sensitive data that has to withstandard physical intrusion (e.g. the signing keys for a CA) normally you would wrap it in tamper reactive crypto hardware. You could put somet

Please use https://www.lowendtalk.com/search?Search=sgx before posting requests like that.

Could you link me to the SGX thread please. Think I missed that one.

Hetzner has Epyc dedis and I've thought of using SEV for something. On a VPS the concept is more dubious, per the SGX thread.

Hmm ok I better check the SGX docs, but I thought it usually involved a certificate from the individual unit (something like an HSM serial number). So there wouldn't be a way for a host to make 1000s

No. Virtual servers are virtualized (that's why they call them virtual) and all the hardware is emulated (thus the EMU in QEMU) as far as you can tell. That includes the SGX. There is no way to kn

Well, not exactly. That's the whole point of SGX: nothing but your enclave has access to your data. Not ring0, nor bios, etc. But, if by "could control it" you mean it can DoS your e

Um it would sort of defeat the purpose since the vps host could control it. Plus SGX seems more and more bogus in the face of attacks like Spectre. SGX only makes even minimal sense on a dedi, and

Last few generations of Intel CPUs support SGX, a set of extensions for secure computing.

(Quote)

(Quote)