- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Sir/Madam,
I am wondering about if I need to trust BIOS when using SGX platform. It seems to me that BIOS controls the firmware update including the microcode update. And BIOS controls the generation of CPUSVN. So if a malicious user reverse engineered the BIOS and switch it to his homebrew version. Can he downgrade the microcode version and still put the updated CPUSVN version number in QUOTE REPORT during remote attestation?
Thanks!
Rd
Link Copied
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Rd,
You don't need to trust the bios for that. While you do update microcode through the BIOS, or by running an Intel script with root permissions, it is a one-way transition till the next reboot, that cannot be reverted without restarting the machine. You don't need to worry about the BIOS if you correctly check the attestation quote you receive from the enclave which contains the CPUSVN. If the microcode is downgraded, the enclave would neither be able to attest to a more recent CPUSVN, nor derive a sealing key to access any data sealed under the more recent CPUSVN. While the BIOS helps you update the microcode, the CPU itself is producing the attestation quote.
Yan,
Anjuna.io
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Michalevsky, Yan wrote:Hi Rd,
You don't need to trust the bios for that. While you do update microcode through the BIOS, or by running an Intel script with root permissions, it is a one-way transition till the next reboot, that cannot be reverted without restarting the machine. You don't need to worry about the BIOS if you correctly check the attestation quote you receive from the enclave which contains the CPUSVN. If the microcode is downgraded, the enclave would neither be able to attest to a more recent CPUSVN, nor derive a sealing key to access any data sealed under the more recent CPUSVN. While the BIOS helps you update the microcode, the CPU itself is producing the attestation quote.
Yan,
Anjuna.io
Hi Yanm
Thanks for your reply! Correct me if I am wrong. My current understanding is that bios or root can update the microcode, and the microcode update will update the CPUSVN. When a CPUSVN is embedded into a report, it actually comes from the CPU directly (through some microcodes or specific instruction?). So BIOS has no way to interfere with the process of correct CPUSVN getting report.
Am i right?
Thanks!
Rd
![](/skins/images/C4F7392A5C68ACA60290C9576F107044/responsive_peak/images/icon_anonymous_message.png)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page