Enarx - Attested, Secured Execution with AMD’s SEV
Talkat Linux Security Summit North America 2019 · on Monday, 2019-08-19· at 09:05· Sapphire D, Hilton San Diego Bayfront·
summary
Enarx targets running customer code inside an encrypted VM using AMD SEV/SEV-ES with attestation, platform Diffie‑Hellman, launch measurements (HMAC) and secret injection so the host never sees keys or plaintext. The project is written in Rust, places a WebAssembly JIT inside the TEE, and demonstrates delivering encrypted code into an empty VM, running it (3+4 → 7) with a local attestation plus execution latency around 50 ms; SEV gen1 limits were 15 keys, gen2 supports 509.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:30AMD Secure Encryption
- 5:23SES
- 9:25How a VM is started
- 11:00Platform DiffieHellman key
- 12:53How it works
- 16:30Problems
- 18:32Trusted Execution Environments
- 19:46Industry Approaches
- 22:34The Problem
- 22:51The NArcs Project
- 24:09Deployment Model
- 25:14Best Practices
- 26:20Demo
- 30:17Inarch Keep
- 31:12Questions
- 31:59Alternatives
- 34:38Mono Kernel
- 42:32WebAssembly
related talks
53mEnarx - secured, attested execution on any cloud
38mEnarx for Confidential Computing
40mConfidential Computing Across Multiple Clouds and Platforms: Project Enarx
40mConfidential Computing and Privacy-Enhancing Technologies - The Landscape
35mVeracruz: Privacy-preserving mutliparty computation using trusted hardware
33mAMD Encrypted Virtualization Update
38mOne Ring -3 To Secure Them All: Computing with Hardware Enclaves
20mHyperEnclave: An Open and Cross-platform Trusted Execution Environment