SecureValueRecovery

Basically, they planned to get around much of the problem by depending on a very insecure secure enclave to make up for a lack of basic sound security practices. The scheme they came up with to store user data in the cloud was described here: https://signal.org/blog/secure-value-recovery/ The code is here: https://github.com/signalapp/SecureValueRecovery This site does a pretty good job of explaining why this isn't a good design: https://palant.info/2020/06/16/does-signals-secure-value-rec... I'm sure I've linked to it already, but please review the discussion here as well: https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac... Even more details here: https://community.signalusers.org/t/wiki-faq-signal-pin-svr-...

I know. I really wish they had a simple page that explains everything. They've gone to great lengths to be confusing about what they're collecting and how. There were several complaints about misleading communication when this change rolled out Examples: https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... They've never updated their privacy policy to cover their new data collection practices even after requests (see https://community.signalusers.org/t/can-signal-please-update...) The scheme they came up with to store user data in the cloud was described here: https://signal.org/blog/secure-value-recovery/ The code is here: https://github.com/signalapp/SecureValueRecovery This site does a pretty good job of explaining why this isn't a good design: https://palant.i

Consider writing some small-ish tasks (e.g. here: https://github.com/signalapp/SecureValueRecovery/issues) that interested folks could look at to see if the work is interesting.

if it's anything like what other big players are doing: the attempts are limited and the code will destroy its knowledge of the key once you reach this limit. Looking at the code quickly I see that nothing is documented and it's not clear what code gets executed there. So good luck understanding what they're doing. But it seems to be using Raft, probably to bring several HSMs to consensus on what's the state of the number of attempts. And it does seem to erase stuff if you reach some threshold of attempts: https://github.com/signalapp/SecureValueRecovery/blob/00d023... My follow up question is: what prevents someone from destroying your account's backup key by entering wrong PINs for your account?

Basically, SGX: https://github.com/signalapp/SecureValueRecovery The enclave is hardened against Spectre and LVI with this (BOLT/LLVM based), and other techniques: https://github.com/signalapp/BOLT The last build step before signing is a verifier that checks that there are no missed mitigations, built using Intel Xed, to try to avoid potential missing mitigations due to an LLVM or BOLT bug.