Hacker News Reader

Comment by Simple8424 | Hacker News Reader

Is this making confidential computing obsolete?

In their current form, AMD and Intel proposals never fulfilled the Confidential Computing promises, one can hope they will do better in their next iteration of SGX/TDX/SEV, but they were always broken, by design.

That's like saying a security vulnerability in OpenSSL/SSH is making SSL/SSH obsolete.

It's a bit more fundamental in my opinion. Cryptographic techniques are supported by strong mathematics; while I believe hardware-based techniques will always be vulnerable against a sufficiently advanced hardware-based attack. In theory, there exists an unbreakable version of OpenSSL ("under standard cryptographic assumptions"), but it is not evident that there even is a way to implement the kind of guarantees confidential computing is trying to offer using hardware-based protection only.

Proof of existence does exist. Some Xbox variant has now been unbroken (jailbroken) for more than 10 years. And not for lack of trying.

Credit/debit cards with chips (EMV) are another proof of existence that hardware-based protection can exist.

> It is not evident that there even is a way to implement the kind of guarantees confidential computing is trying to offer using hardware-based protection only.

Not in the absolute, but in the more than $10 mil required to break it (atomic microscopes to extract keys from CPU gates, ...), and that to break a single specific device, not the whole class.

As soon as a bad actor has a single key the entire class is broken since the bad actor can impersonate that device, creating a whole cloud of them if they want.

You would not be able to use that cloud of impersonated device online - Microsoft would see that device connecting multiple times and ban it.

And the key would not allow you to jailbrake another Xbox.

So at most you might be able to make a PC look like an Xbox, but a PC is more expensive to start with.

So unclear exactly what you have accomplished.

Reply on news.ycombinator.com