Question about Enclave paging encryption Key (CR_BASE_PK)

SONGSONG_L_ — Fri, 25 May 2018 15:18:30 GMT

Dear,

In the Intel software developer's manual (SDM), I found that evicted pages would be encrypted via AES-GCM with the key CR_BASE_PK. Here is the pseudo-code from SDM:

(* Encrypt the page, DS:RCX could be encrypted in place. AES-GCM produces 2 values, {ciphertext, MAC}. *)
(* AES-GCM input parameters: key, GCM Counter, MAC_HDR, MAC_HDR_SIZE, SRC, SRC_SIZE) *)
{DS:TMP_SRCPGE, DS:TMP_PCMD.MAC} <- AES_GCM_ENC(CR_BASE_PK, (TMP_VER << 32), TMP_HEADER, 128, DS:RCX, 4096);

And the SDM also indicates that the key CR_BASE_PK is an internal CREG.

In the SGX patent (https://patents.google.com/patent/US20120159184A1/en), I found the evicted pages is encrypted by CMA (old name of MEE). Quote from patent:

"When enclave pages residing in the EPC is evicted from the cache to the main memory outside the CPU package, it is protected by CMA (Crypto Memory Aperture) encryption. The CMA will encrypt the data to provide data confidentiality. The integrity of the EPC is provided by range registers that prevent reads and writes to the EPC."

So my question is whether the encryption key CR_BASE_PK is generated and used by MEE. If not, is it hard-coded inside CPU? Is it related to enclave key generation? Do all enclaves share the same key for paging encryption?

topic Question about Enclave paging encryption Key (CR_BASE_PK) in Intel® Software Guard Extensions (Intel® SGX)

Question about Enclave paging encryption Key (CR_BASE_PK)