https://hackerpaper.kaipfister.de/p/1701.01061/Collected HN comments and submissions linking this paper.enMon, 02 Nov 2026 11:16:22 GMThttps://news.ycombinator.com/item?id=14619347urn:hackerpapers:mention:1701.01061:14619347Fri, 23 Jun 2017 14:25:50 GMT<p>An enclave does not make any system calls directly like the rest of the process would, but a system call can definitely be made through the use of a shim layer. In SGX parlance, calls to the outside of the enclave are known as OCALLs. The danger with relying on values returned by a syscall is that the OS could be lying. As an exercise, you could implement a simple &quot;hello, world&quot; filesystem driver that hides the presence of certain files. So, as long as the enclave has no trusted path to I/O, it must rely on the operating system, which is assumed compromised. If the enclave decrypts protected…</p><p><a href="https://hackerpaper.kaipfister.de/p/1701.01061/">Paper and discussion history</a>. A mention is not an endorsement.</p>cs.CRhttps://news.ycombinator.com/item?id=14058297urn:hackerpapers:submission:1701.01061:14058297Fri, 07 Apr 2017 09:16:29 GMT<p>SGXIO: Generic Trusted I/O Path for Intel SGX</p><p></p><p>2 points; 1 discussion reply on HN. <a href="https://hackerpaper.kaipfister.de/p/1701.01061/">Paper and source history</a>. A submission is not an endorsement.</p>cs.CR