What are the ramifications of this exactly?
> The signing tool supports a single-step signing process, which requires
> the access to the signing key pair on the local build system. However,
> there is a requirement that any white-listed enclave signing key must
> be managed in a hardware security module. Thus, the ISV’s test private
> key stored in the build platform will not be white-listed and enclaves
> signed with this key can only be launched in debug or prerelease mode.
A debuggable SGX enclave enables read-a-word and write-a-word primitives, so loses its confidentiality and integrity.
Alternatively, someone leaks an SGX exploit that bypasses it all, and we wonder whether it was a mistake like so many other vulnerabilities, or if someone deliberately put it there because they didn't believe in Intel having that amount of control... "I wish for the insecurity that brings us freedom."
SGX doesn't really give Intel "control" in the sense of taking away existing freedoms. It's a new feature. You can always elect not to use it, or not to use software that uses it.
That's always the excuse given for every new invasive user-hostile feature. The problem is when the majority of new applications and websites require it. You can always elect not to use a computer either, but I think such a position would be untenable even for a "extreme Stallmanist".
https://software.intel.com/en-us/articles/intel-trusted-exec...
Details: if the key used to sign architectural enclaves (like the Launch Enclave) would leak, this would completely break SGX. Anyone with the key could create their own Quoting Enclave and the guarantees behind software attestation would go down the drain.
I want to use SGX to protect cryptographic keys. Attestation is mostly unnecessary.
For normal computing, as long as you control the machines and can bootstrap trust yourself, you don't need Intel's attestation mechanism at all. You do, however, need to ability to launch an enclave.
If the OS is evil and you don't do attestation, it can emulate SGX and run your code in a simulated enclave environment where EGETKEY returns keys that the OS knows about.
If the OS is not evil, you can use process isolation to generate and protect the keys.
Ignoring the cloud computing aspect of SGX, no amount of attestation can recover from your-OS-is-compromised-from-day-one scenario. The attestation is only as good as its verifier.
One of the primary use cases for this technology is cloud computing. Amazon, Google, etc are all quite capable of patching such checks out of the kernel if they want to use SGX. All it'd do is annoy a few engineers at these companies. Likewise, for deployments on the client, it's really only the Microsoft and Apple kernel devs that matter given the Linux communities tiny desktop market share, and I don't see why they would do that.
Of course, it's silly if you think the kernel won't accept a patch for SGX on moral grounds. It already has several modules for DRM technologies, along with binary blobs for drivers. But it's nice to think about.
SGX is an optional feature. It doesn't magically run software against your will and it is not "immoral". Ascribing moral positions to CPU features seems ridiculous to me, sort of like describing a pickaxe as "immoral". If you don't want to use it, then don't execute software that includes SGX instructions. If you do want to use it, then all Linux getting in your way will do is convince you that maybe you should be using a different kernel whilst you wait for Intel's own driver to compile and install.
Based on public docs, you can't do DRM decoding in an enclave. But you can execute some complex logic to validate a user's license and decide whether you want to release the encryption key to the ME or GPU.