Memset-ing on enclaves

Elephant — Fri, 24 Nov 2017 01:19:45 GMT

hi,

I noticed on a lot of sgx code examples that they explicitly memset allocated variables to 0 before leaving the trusted zone. Any insight on this? Ithought enclaves' EPC is protected and doing memsets will reduce performance of applications.

Thanks!

Kind Regards,

Elephant

The reason of using memset is

Hoang_N_Intel — Tue, 12 Dec 2017 08:43:09 GMT

The reason of using memset is documented in the SGX Developer Guide at https://download.01.org/intel-sgx/linux-1.9/docs/Intel_SGX_Developer_Guide.pdf under the section of "Disposal of Enclave Secrets".

Here is an excerpt: "The enclave writer must use the memset_s() function to clear any variable that contained secret data. The use of this function guarantees that the compiler will not optimize away the write to memory intended by this function call and thus ensuring the secret data is cleared. Using memset_s() is especially important when secret data is stored in a dynamically allocated buffer"

topic Memset-ing on enclaves in Intel® Software Guard Extensions (Intel® SGX)

Memset-ing on enclaves

The reason of using memset is