September 3, 2024 at 06:51AM
Security researcher Mark Ermolov claims to have made progress in hacking Intel’s SGX data protection technology, extracting cryptographic keys. Johns Hopkins University’s Pratyush Ranjan Tiwari highlighted the severity of this breach, affecting older processors widely used in embedded systems. Intel responded, stating the tests were conducted on unmitigated systems with physical access. Ermolov is confident the extracted key can be decrypted, posing a threat to Intel’s SGX remote attestation feature.
After reviewing the meeting notes, it is clear that there has been a significant development related to the Intel SGX data protection technology. A security researcher, Mark Ermolov, claims to have extracted cryptographic keys pertaining to Intel SGX, specifically the Root Provisioning Key (FK0) and Root Sealing Key (FK1). This has serious implications for the security model of SGX, potentially allowing decryption of sealed data and unauthorized creation of attestation reports.
Moreover, it has been highlighted that the compromised processors, Apollo Lake, Gemini Lake, and Gemini Lake Refresh, have reached end of life but are still widely used in embedded systems. Intel has responded publicly, clarifying that the tests were conducted on systems with physical access, lacking the latest mitigations and proper configurations. They emphasized that the extracted key is encrypted and would require breaking the encryption for malicious use, noting that it would only apply to the individual system under attack.
Ermolov has stated that the encrypted key will likely be decrypted and that the encryption key is not unique. Tiwari has also noted that the GWK, which is shared across all chips of the same microarchitecture, poses a potential risk if obtained by an attacker.
The main concern highlighted by Ermolov is not access to local enclave data, which requires physical access and has already been mitigated by patches on EOL platforms, but rather the ability to forge Intel SGX Remote Attestation. The SGX remote attestation feature is designed to verify that software is running inside an Intel SGX enclave on a fully updated system with the latest security level.
Given these developments, it is important for stakeholders to closely monitor any further updates and potential mitigations from Intel and to consider the implications for systems utilizing Intel SGX technology. Additionally, ongoing research into vulnerabilities related to Intel processors and security technologies should remain a focus for relevant entities.