# Reflections on SGX

DevFeed: [Reflections on SGX](<https://devfeed.tech/articles/reflections-on-sgx-35188.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/reflections-on-sgx/>)

Published: 2019-02-19T17:16:52Z

Content type: opinion

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Docker](<https://devfeed.tech/topics/docker.md>)

Tags: [cloud](<https://devfeed.tech/tags/cloud.md>), [containers](<https://devfeed.tech/tags/containers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [opinion](<https://devfeed.tech/tags/opinion.md>), [security](<https://devfeed.tech/tags/security.md>), [side-channel](<https://devfeed.tech/tags/side-channel.md>)

## AI overview

The author revisits Intel SGX after receiving additional context about its origins as DRM technology and its later use for code execution in enclaves. The article discusses HAVEN, encrypted memory for using cloud services without trusting the provider, running Docker containers inside enclaves, and unresolved side-channel attack challenges.

## Source excerpt

I like to consider all the variables in a problem space before coming to a conclusion. As humans we have a tendency to jump to conclusions rather quickly. I try not to do this but everyone makes mistakes. More information about Intel SGX was brought to my attention after my initial blog post on it. I'd like to take the time to go through that information and my current thoughts on the technology after having this extended context. Trammel Hudson (@qrs) pointed out to me yesterday that SGX was originally built for the use case of DRM for Netflix, Microsoft, etc. Having this context makes the problems that arise when you try to do code execution inside an enclave seem like a forgivable sin. It was not until the HAVEN paper that people even considered using enclaves as an execution environment. In that regard, the HAVEN paper was truly novel. I may disagree with shoving an entire operating system in there, but the idea of executing code in an environment with encrypted memory as a way to use the cloud without trusting the cloud is a respectable feat. Another person who I truly respect and admire for the thought they put into what they build is Joanna Rutkowska (@rootkovska). She recently started working at golem a shared compute providing company focused on security and privacy. She wrote an awesome blog post considering all the tradeoffs of a technology such as SGX. The post links to other posts where she really weighs the pros and cons of the technology. This is why I really respect her thoughts on the matter. The solution is pretty cool in that you can run docker containers inside the enclave. It's better than the SCONE paper, which also runs containers, in my opinion, because it doesn't do the crazy syscall toss outside the enclave. It's more aligned with the HAVEN paper in that it includes all the code inside the enclave. Her post is great; it really goes into detail on their thought process and what they designed their solution to prioritize. Considering SGX was