topic Thank you so much for in Intel® Software Guard Extensions (Intel® SGX)

Export enclave

ssziy — Tue, 10 Sep 2019 07:57:25 GMT

Good morning,

Does Intel SGX SDK provides a way to clone enclaves? That is, being able to boot an enclave from a machine on another machine with exactly the same content / secrets.

Hi Stevie.

Scott_R_Intel — Tue, 10 Sep 2019 12:55:01 GMT

Hi Stevie.

No, this is not supported, by design. If you need to share secrets between enclaves between machines, one way to do so would be to use remote attestation to both enclaves and provision a shared key directly to the enclaves to seal/unseal the secrets between the two enclaves.

Regards.

Scott

Thank you so much for

ssziy — Tue, 10 Sep 2019 18:55:35 GMT

Thank you so much for answering my question.

Following your answer I would just like to ask you just one more question. In this case where we talk about sharing/copying secrets between different enclave machines we are also dealing with different enclaves. With this, it is possible to derive a key using the sgx_get_key function in one machine enclave and share it with the other machine enclave to seal and unseal the secrets?

Hi again.

Scott_R_Intel — Tue, 10 Sep 2019 19:36:04 GMT

Hi again.

As mentioned in the post below, SGX keys are unique to each specific platform:

https://software.intel.com/en-us/forums/intel-software-guard-extensions-intel-sgx/topic/705026

So, my previous answer still applies... you'd need to utilize SGX remote attestation to provision shared keys between your enclaves if on different machines.

Regards.

Scott

Got it. Thanks again for

ssziy — Tue, 10 Sep 2019 20:34:48 GMT

Got it. Thanks again for taking your time to help me Scott. Rest of a good week.

Best regards.