State of Intel SGX in Linux

on YouTube ↗46m

" summary

Linux has mainline SGX support since late 2020 with the kernel interface (create/extend/finalize enclaves, EENTER/ERESUME, EREPORT) and userland attestation using quoting enclave and Intel PCKs via the cloud. Upstream timeline: initial merge Feb 2021, KVM/NUMA in 5.30 (June 2021), MCE poison handling in 5.17, cgroup accounting and dynamic enclave memory (stx2) arriving in 6.0. EPC is partitionable for VMs; KVM avoids oversubscription. Runtimes include Intel SGX SDK, Graphene, and Profian NRX (WebAssembly) which demonstrates per-workload per-CPU certificates and an attestation flow tied to mainline kernel since late 2020.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 15:34Post-mainline
3. 20:25Dynamic memory
4. 28:50KVM
5. 30:30Execution (EENTER)
6. 39:27Runtimes

" related talks

• 35mBringing Intel SGX to the Rust EcosystemYu Ding · RustFest Paris 2018
• 32mSecure Container with SGX: Protecting Secret in Cloud EnvironmentIsaku Yamahata, Xiaoning Li · KubeCon + CloudNativeCon China 2019
• 48mSGX Secure Enclaves in Practice: Security and Crypto ReviewJean-Philippe Aumasson, Luis Merino · Black Hat USA 2016
• 46mAutomatically Securing Linux Application Containers in Untrusted CloudsANJO VAHLDIEK-OBERWAGNER, DMITRII KUVAISKII · Linux Security Summit North America 2020
• 32mSecure Container with SGX: Protecting Secret in Cloud EnvironmentIsaku Yamahata, Xiaoning Li · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 19mAttestation and identity provisioning to Intel SGX workloadsAndrey Brito · Production Identity Day: SPIFFE + SPIRE 2020
• 11mIntroductionsPaul O’Neil · Confidential Computing Mini Summit at Open Source Summit Europe 2023
• 15mSecured Routines: Language-based Construction of Trusted Execution EnvironmentsAdrien Ghosn, James R. Larus, Edouard Bugnion · USENIX ATC '19