topic Hi Scott, in Intel® Software Guard Extensions (Intel® SGX)

ENCLAVE DATA STORAGE

ROY__NIRJHAR — Tue, 15 Jan 2019 14:07:04 GMT

Lets say I have the enclave.cpp file and I have a global variable "secret _key". Will the variable "secret_key" will reside in the protected enclave space? If not how to have some global variables whose value will be stored in the enclave and not in the untrusted space?

Also if i have a function func1() in enclave.cpp but it is not declared in the enclave.edl file, then will the function be a part of the enclave or will be available in the untrusted memory location?

Hello Nirjhar.

Scott_R_Intel — Tue, 15 Jan 2019 23:06:51 GMT

Hello Nirjhar.

Yes, once an enclave is instantiated, global variables in the enclave reside in protected memory. But, to be clear, any variables initialized at compile time will be in the clear in the enclave binary, as that is not encrypted in any way. To get a "secret_key" securely into your enclave you would need to use SGX remote attestation to help securely provision the secret from a remote entity.

Any function defined in your enclave.cpp will also be in trusted memory, whether its defined in the EDL or not. The EDL is just what defines the functions that can be called to/call out from inside the enclave. So in your example, func1() would reside in secure memory and would only be callable from inside the enclave.

Regards.

Scott

Hi Scott,

Hszz09 — Wed, 23 Jan 2019 09:03:28 GMT

Hi Scott,

Is there any way to send secrets to the enclave in asymmetrically encrypted way, say ECDSA+AES? with the enclave's public key. So that anybody can just transmit the encrypted data to the untrusted environment and then pass to the enclave.

Or does it has to go by remote attestation in interactive way? that requires the secret holders to be online during the secret transmission.

Scott R. (Intel) wrote:
Hello Nirjhar.
Yes, once an enclave is instantiated, global variables in the enclave reside in protected memory. But, to be clear, any variables initialized at compile time will be in the clear in the enclave binary, as that is not encrypted in any way. To get a "secret_key" securely into your enclave you would need to use SGX remote attestation to help securely provision the secret from a remote entity.
Any function defined in your enclave.cpp will also be in trusted memory, whether its defined in the EDL or not. The EDL is just what defines the functions that can be called to/call out from inside the enclave. So in your example, func1() would reside in secure memory and would only be callable from inside the enclave.
Regards.
Scott