Intel Attestation Service

marcos_a_ — Tue, 09 May 2017 21:22:20 GMT

Hi,

If I understand well, the "SGX Software Attestation" process relies on a "Key Generation Facility" and "Provisioning Service", both from Intel.

This is part of Intel SGX Infrastructure Services. So, if I design an Intel based product, I must have connection to Intel "Provisioning Service" via internet in order to validate and get the "Attestation Key" and then be able to setup my Enclave. Is that right?

This will also be necessary every time I have to change BIOS, any SGX based software updates, etc, correct?

It is possible that if someone get those provisioned keys from Intel "Provisioning Service" being able to access my Enclave (assuming that he also has physical access to my hardware product?

Thanks for the information,

Rgds

Marcos

Hi,

Anusha_K_Intel — Wed, 10 May 2017 12:58:23 GMT

Hi,

Yes its correct.

This will also be necessary every time I have to change BIOS, any SGX based software updates, etc, correct?

Yes its correct.

Please go through this document for further reference regarding attestation service:

https://software.intel.com/sites/default/files/managed/ac/40/2016%20WW10%20sgx%20provisioning%20and%20attesatation%20final.pdf

topic Hi, in Intel Confidential Computing

Intel Attestation Service

Hi,