FIPS or CC validation

Lauritzsen__Roar — Tue, 11 Feb 2020 14:18:48 GMT

Is Intel aware of or currently involved in any effort to validate or certify SGX according to formal specifications such as FIPS 140 or Common Criteria? We are faced with customers who would value such validation, and we are wondering if anything can be said along those lines.

Hello Roar,

JesusG_Intel — Wed, 12 Feb 2020 16:45:20 GMT

Hello Roar,

FIPS and the like don’t certify instructions or Trusted Execution Environments like SGX provides. They certify crypto algorithms and functions at the lower levels and even hardware components (chassis intrusion detection, environmental conditions or fluctuations, even protections against radiation/EMP) at the upper levels. Some orgs have used SGX and gotten FIPS 140-2 certifications, e.g. WolfSSL and Fortanix, using SGX, but you can’t actually get a FIPS certification for SGX itself. This Wiki has a good description.

Regards,

Jesus

Intel Customer Support

topic FIPS or CC validation in Intel® Software Guard Extensions (Intel® SGX)

FIPS or CC validation

Hello Roar,