eweekchat

A5: I do hope to see a world where "confidential computing" is enabled by default at every cloud provider. From the performance benchmarks we're seeing from different providers, the drawbacks seem fairly limited.

A5: When we talk about our personal data, whether it’s messages sent to our loved ones, financial records, or health records, I expect my data to be handled securely. When using Face ID, Apple doesn't ask the user "do you want to use the Secure Enclave to protect your face map?"

Subject to computational cost my sense is that yes this will happen. CC is something where the building blocks exist.

right. but. if data was compromised on the disks themselves and that data was called into the compute environment, CC won't help, right?

@brucekornfeld If the data was encrypted at rest using a key only known inside the TEE, then compromising the data just renders it detectably corrupted. Thus is is a DoS attack (like removing the disks would be) rather than data tampering.

Corrupted data can't be fixed by security components in HW

So Apple (I believe) do this, they use the T2 chip to monitor the core OS, if a core file is changed they put back the old file.