LAUNCHCONTROL CANNOT DISCOVER LAUNCH DRIVER
LAUNCHCONTROL CANNOT DISCOVER LAUNCH FULL
LAUNCHCONTROL CANNOT DISCOVER LAUNCH CODE

This is still not a hardware root of trust, since an adversary that gains the ability to modify kernel memory could still technically modify either the lock flag or the lists directly, but the barrier to doing so is arguably much higher then a simple breach of discretionary access controls. Keys that are allowed to sign enclaves that have the provisioning bit set.Īfter key signatures are registered, the lists can be 'locked' to prevent any further modifications to the policies.Keys that are allowed to sign launch enclaves.Keys that are allowed to sign enclaves (signing control).Infrastructure is provided that allows the platform owner/administrator to designate identity modulus signatures of keys that control the following functionality:

LAUNCHCONTROL CANNOT DISCOVER LAUNCH DRIVER

We've attempted to address this problem with a patch to the proposed driver that adds cryptographic initialization policy management to the driver, to the extent that such policy can be implemented on a platform with Flexible Launch Control.

LAUNCHCONTROL CANNOT DISCOVER LAUNCH CODE

Since EDMM allows the dynamic loading and execution of code, an adversary can simply load a bootstrap enclave that can setup a confidential communications link to a command and control server and then download, over an encrypted channel, any adversarial code that is desired. The potential security implications of this are well understood and are particularly problematic on SGX2 platforms that implement Enclave Dynamic Memory Management (EDMM). any adversary that can defeat discretionary access controls can load and run enclave based code.

LAUNCHCONTROL CANNOT DISCOVER LAUNCH FULL

This is problematic from a security perspective in that a full hardware chain of trust cannot be established, ie. All of this effectively leaves the notion of 'launch control' to be the discretionary access controls that are applied to the SGX driver device node. The driver computes the identity modulus signature of the enclave signing key and sets the launch control registers to that value. The driver is instead configured to initialize any enclave that is handed to it. This denies the ability to even load a launch enclave on Linux. In addition to the inability to pass a launch token into the kernel, the driver will refuse an attempt to initialize an enclave with the EINITTOKEN_KEY attribute. Without the ability to pass a launch token into the kernel, a launch enclave has little or no value. In fact, the ability to pass an initialization token (EINITTOKEN) to the ioctl system call that carries out enclave initialization has been specifically removed. We are deeply involved with this issue so some background and clarifications for the benefit of everyone targeting SGX based solutions on the Linux platform, particularly groups that are interested in third party launch control.Īt the current time, the driver that is proposed to become the mainstream Linux driver has no support for launch control. The issue surrounding launch control, at least on Linux, is a bit complex at this point. Hi, I hope the week has gone well for everyone, despite all of the ongoing world events.

Launchcontrol cannot discover launch