1

I have been looking into SGX (Intel's Software Guard Extension) for the last few days. It sounds like a very useful technology with some significant security advantages for many pieces of software. However, I have yet to identify a single piece of software that utilizes SGX on Windows 10. That's not to say there aren't any, but I use the same software on a CPU that supports SGX and one that doesn't, and none of the software seems to care either way. Windows 10 itself doesn't seem to be concerned with SGX support being present in the CPU.

Does SGX currently provide a meaningful benefit to desktop operating systems?

As a bonus, if you know of any pieces of software that utilize SGX on Windows 10 I'd like to know.

|improve this question
2

I know of at least 4 applications using SGX:

Software Ultra HD Blu Ray players are required to run decryption in an SGX enclave to prevent the DRM keys from compromise.

Windows 10 itself utilizes SGX in System Guard Runtime Attestation, which allows it to report to a third-party whether Windows has been tampered with. The SGX enclave prevents malware from tampering with the measurement process.

Intel Online Connect is an implementation of the FIDO U2F 2-factor standard that runs in an SGX enclave instead of a USB dongle.

Some match-on-host fingerprint readers use SGX to prevent compromise of fingerprint data by malware on the system.

|improve this answer
  • It may be important to note that a myriad of side-channel attacks have broken SGX confidentiality. – forest Feb 8 at 8:08
  • Regarding System Guard Runtime Attestation, the document you linked to mentions SGX. However, this (possibly newer) documentation doesn't mention SGX at all, and instead talks about "VBS Enclaves" (Virtualization-Based Security). Is it possible that Runtime Attestation is going to be implemented using Hyper-V, like Core Isolation and Memory Integrity, rather than SGX? – jdgregson Feb 8 at 18:28
  • @jdgregson On page 36 of the Windows 10 Octagon PDF, it says it uses VBS enclaves where SGX is not available, and notes that VBS doesn't protect against some forms of attack that SGX does. – user71659 Feb 8 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.