Hardware Security

What characterizes enclave-style TEEs such as Intel SGX?

  1. AThe entire OS kernel runs from an external hard disk
  2. BPart of an application runs in a region whose memory the CPU encrypts and protects, so even the OS and hypervisor cannot read it
  3. CAnyone can freely modify data inside the enclave
Show answer and explanation

Answer: B. Part of an application runs in a region whose memory the CPU encrypts and protects, so even the OS and hypervisor cannot read it

In an enclave, only the part of an application handling secrets runs in a special memory region, which the CPU encrypts and integrity-protects before it reaches main memory. Neither the OS, the hypervisor nor an attacker physically reading memory can see its contents. Only the CPU and that code need be trusted. Vulnerabilities to side-channel attacks have also been reported, so careful use is needed.

  • A. It does not run from an external disk.
  • B. Correct. The trusted base shrinks to the CPU and part of the app.
  • C. Data inside is protected.
Practice this topic Back to topic

More Hardware Security questions

  1. In confidential computing on the cloud, what is the purpose of CPU features that encrypt virtual machine memory (such as AMD SEV or Intel TDX)?
  2. Which describes a PUF (physically unclonable function)?
  3. What is the advantage of using a PUF for key storage?
  4. What property does an SRAM PUF exploit?
  5. Why is error correction (such as helper data) combined with PUFs when deriving keys?