> I’m not very familiar with SGX, though, so maybe there’s some magic I’m missing here.
There is magic you are missing. I don't want to be the person that glibly says "you should read more about this" and then vanishes, but because I don't have time to write out what the magic is, that's exactly what I'm going to do :(
The magic does allow users to verify that the software they're talking to is what it says. Specifically, it also allows users to set up an encrypted channel with the processor that is running the software that is attested, so you exactly can't do the attack you propose of shuttling attestation to one system and actual data to another.
The technology is pretty cool, you should check it out!
I don't want to glibly dismiss your comment either, but I fail to see how this helps users at all. From what I can tell, you're correct that the SGX connection can be structured such that attestation cannot be spoofed by sending the data request to a different service (assuming you trust Intel), but that doesn't really help end users.
1. Intel does not bill the technology for this purpose, which makes me doubt its fitness. SGX is very specifically billed as being for developers who want to run secure software in an untrusted environment, not for end users who don't trust the developers. These are wildly different scenarios.
2. The "encrypted channel with the processor" implies direct access to individual machines, which is impractical at Google scale.
3. The attestation is for binaries and not source, so attesting that the binaries are unchanged doesn't help users verify that the binaries match the trusted source. (Of course Google also doesn't publish the GMail source anyway.)
Signal actually just wrote up a very detailed post about how they're using SGX to provide verification that the computer you're sending your data to is running a specific algorithm: https://signal.org/blog/private-contact-discovery/
That's pretty cool, and a good write-up, too. Thanks for the link.
Obviously still doesn't help for the GMail case unless Google starts publishing their code, and they pretty much give up on email search, and somehow the whole chain of email cross-provider lands in these enclaves, but it's very interesting.
There is magic you are missing. I don't want to be the person that glibly says "you should read more about this" and then vanishes, but because I don't have time to write out what the magic is, that's exactly what I'm going to do :(
The magic does allow users to verify that the software they're talking to is what it says. Specifically, it also allows users to set up an encrypted channel with the processor that is running the software that is attested, so you exactly can't do the attack you propose of shuttling attestation to one system and actual data to another.
The technology is pretty cool, you should check it out!