So you don't ask for much then :). As I'm sure you're aware, even with TPMs/TXT/SGX/Trustzone etc, once your threat model includes a capable adversary like the NSA with physical access to your box, it's hard to see how you can provide bullet-proof guarantees. I'm excluding fully homomorphic encryption based systems on the grounds of practicality here (although there are interesting 'somewhat homomorphic' systems out there that achieve practicality by restricting what kind of operations you can perform on the data).
I guess, but it still seems like no one offers this and its not trivial. Do you know of any research/systems/practical offerings in this area? This has been something that I would be interested in learning a lot more about honestly. I agree that bullet-proof guarantees are basically impossible and that physical security is probably going to be the weak point at the end of the day. Maybe some system could be created that made it hard to individually tamper with one instance without alerting others, or made it hard to isolate one from another from a hardware view? Do you think even something like SGX can't prevent some level of physical threats? It seems like it would at least make it harder/reduce the scenarios in which hardware is vulnerable, but I haven't researched it extensively.
SGX is pretty reasonable IFF you believe in the Intel PKI.
I have been looking at how to do cheap ($20-50 slow USB connected (essentially smartcard), $500-1000 PCIe) HSMs. If you do shared-computation with a host (with or without SGX/TXT), you can get pretty decent performance with quite modest HSM hardware.
Those provide NSA-type protection -- in that attacking a single instance isn't guaranteed, and takes time, so a system with key rotation or k of n split across locations is going to provide pretty reasonable security.
Private Core is definitely the most interesting TXT-based solution today; if you built an IaaS provider with that tech plus live video monitoring, alarms, etc., you could probably offer quite reasonable security assurances to people. (i.e. the tools to defeat it require physical access, and if no one can gain physical access to a rack once the rack is put into production...)
The k of n split across multiple locations idea is interesting.
I agree that if you're paranoid about the NSA it probably doesn't make too much sense to have faith in the Intel PKI. When you say pretty decent performance for your HSM, do you mean less than 10 % for real world apps?
I'm currently assuming a threat model where an attacker doesn't have physical access however, and looking more into how to use hardware to bootstrap a minimal TCB that doesn't require OS or application rewrites but still gives good performance. Even if only for specific use cases.
ARM or possibly Atom in a box, so pretty decent performance. The pain of the HSM is the physical packaging, and my ultimate goal is to make that reusable and let users select their own components and do their own final assembly and certification.
