I have two comments on this new Signal proposal for backing up secrets:
1. If your solution to a hard problem is “use Intel SGX”, please say so right at the beginning!
2. Despite that criticism, holy cow does this look like sophisticated work. signal.org/blog/secure-va…
1. If your solution to a hard problem is “use Intel SGX”, please say so right at the beginning!
2. Despite that criticism, holy cow does this look like sophisticated work. signal.org/blog/secure-va…
So the basic problem here is an important one: Signal wants to back up your secrets in the cloud, so you can get them back if you lose your device. At the same time, being Signal, they don’t want your secrets accessible to hackers. 2/
Password-based encryption solves the problem, but then you need really strong passwords to prevent offline dictionary attacks. Putting a key on your device helps, but the whole point is to secure against lost devices. 3/
The only way anyone has ever practically solved this problem is to use secure hardware at the service provider. Apple does this with iCloud Keychain. Signal is trying to do the same with SGX. 4/
So the idea is that Signal will run an SGX enclave on its server. All the secrets will live inside of it. You’ll only get the secret if you can show you know the password (presumably with a low limit on guesses.) This works great! 6/
Wait that was 5. This is 6/
If this were an academic paper everyone would just stop there. But Signal is trying to build stuff, and a concern when you build real stuff is: what happens if your server goes down. Does the data get lost? 7/
The good news is that the actual secret “data” shouldn’t be that big. Worst case you could have a single key inside the enclave and use that to derive all the other secrets. The real problem is that you have to keep a counter for each user to prevent guessing attacks. 8/
This is a problem I love. The trick is that you have to make sure every single replica stays in sync here. If there are ten replicas and each gives you five attempts, you can isolate them from each other and get 50 independent guesses. 9/
So the TL;DR of this thing is that they’ve built a whole consensus protocol so that multiple replicas on different cloud providers can stay in sync.
This is so crazy it just might work. 10/
This is so crazy it just might work. 10/
My main criticism of this idea is that I worry that it relies too heavily on the security of SGX, and particularly the SGX attestation process. 11/ 
Intel SGX just keeps getting broken. Last week it was an undervolt attack you could run from software. This week it turns out some Intel setups have the GPU sharing cache lines with the CPU, exposing parts of enclave memory to the former. 12/
This system seems to rely heavily on the use of SGX attestation, which uses a key inside the processor to sign a message that says “I am a real Intel CPU, you can safely send your backup data here.” If that key gets taken out, anyone can impersonate SGX. 13/
To me that seems like the real weak point. Maybe not a likely attack but definitely a little worrying. Other than that, very neat work. ///
