Is Intel SGX Enabled Automatically?

Oddycm

Hello,

I see a blog post about Intel SGX additional in Windows 1Password client. I also see a previous post that indicates there may be a SGX enable/disable option in Advanced settings.

I have Intel SGX enabled in the BIOS, however, I do no see any settings regarding enabling it in 1Password. I also do not see any mention of the string 'SGX' in the 1Password logs.

Should there be an option for it in the GUI or is it turned on automatically?

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

ag_ana

Hi @Oddycm!

Sorry for the late reply here! I just wanted to let you know that I have sent your question to the Windows team, we will post back here as soon as we get an update :+1:

jpgoldberg

Hello @Oddycm,

We no longer make use of SGX, and so it is no longer an option.

SGX offers some really great technologies, for example Signal found a great use of it. And I must say that I very much enjoyed working with people from Intel on this back in the day. But it turns out that the technologies that it offers doesn't really do much for 1Password security. One of the challenges that we faced is that the enclave itself couldn't restrict what OS/user-space process called it. So there was no way to ensure that only a bona fide 1Password app could make use of any secrets we put in there.

Our first use of it with with key derivation, and so this issue didn't come up there. It was a proof of concept in using it. At the time we were exploring the possibility that we could split secrets between process memory and the enclave, but that would only help defend against something that just did a memory dump and had not active component. And in the end, we found a much better way of handling secrets in memory.

So ultimately, we decided that the very small security gain for using it wasn't worth the complexity of maintaining and supporting the use. On the one hand, it's sad that something we experimented with didn't turn out to be as beneficial as originally hoped, but on the other hand, if we aren't finding that we occasionally need to back off things like this then it would mean that we wouldn't be exploring enough.

Signal's use is a good example of what SGX is good for. Given that the code in an enclave can be "attested" it can work as a trusted third party. That is, you know you can give it secrets to process without it leaking anything it shouldn't. But you have less control of who it can give its output to.