topic Re:Question about IAS in Intel® Software Guard Extensions (Intel® SGX)

Question about IAS

hyunsoo — Sun, 22 Nov 2020 13:02:50 GMT

Hi all,

I have two questions about IAS.

1. In remote attestation process, client gives quote to service provider and service provider should pass it to IAS for verification of it. I was wondering how IAS issue ISV's certificate. What materials are examined by IAS?

2. Is there a official document which describes how to get Intel root public key? I could download Intel root key using a command below.

wget https://certificates.trustedservices.intel.com/Intel_SGX_Attestation_RootCA.pem

However, the problem is that this is found in someone's comment in website. I'd like to check the official document associated about this.

Thank you

Re:Question about IAS

JesusG_Intel — Mon, 23 Nov 2020 17:23:39 GMT

Hello hyunsoo,

The answers to your questions are on this page: https://api.portal.trustedservices.intel.com/EPID-attestation.

Fill out the commercial use license request to receive your SGX commercial license and certificate.

You will also find this in the EPID-attestation page: "Attestation Report Root CA Certificate: DER PEM"

Regards,

Jesus G.

Intel Customer Support

Re:Question about IAS

JesusG_Intel — Mon, 23 Nov 2020 19:47:48 GMT

Hello Hyunsoo,

I did not answer your first question correctly because I misunderstood the question.

The only thing IAS examines is the quote sent to it by the service provider. The SGX Attestation API Spec contains the information you are looking for - Chapter 4 Data Structures details the Attestation Evidence Payload, which is what the service provider sends to IAS to be verified.

Is this the information you are looking for?

Regards,

Jesus G.

Intel Customer Support

Re: Re:Question about IAS

hyunsoo — Tue, 24 Nov 2020 01:41:23 GMT

Hi Jesus, Thanks for your kind response.

Your answer is helped me and is right what I want to find in this question. However an additional question is made from your first answer.

Shortly, I know that ISV should receive the commercial license to luanch their enclave for public. This is because the enclave launched without debug mode is not applicable to memory protection. Due to this reason, we should receive the commercial license to launch our enclave with release mode.

So my question is that why ISV(3rd party developers) should be issued the commercial license by Intel?

Thank you

Re:Question about IAS

JesusG_Intel — Tue, 24 Nov 2020 18:10:45 GMT

Hello Hyunsoo,

From the Intel SGX Licensing FAQ:

Why do I have to apply for a commercial use license?

A commercial use license agreement is required to use the Production Services environment endpoints. Intel enters into a commercial use license agreement with companies that meet defined development and security standards. This entitles users of Licensee products utilizing Intel SGX to make certain assumptions about the software they are relying upon.

Regards,

Jesus G.

Intel Customer Support

Re:Question about IAS

JesusG_Intel — Wed, 25 Nov 2020 18:05:47 GMT

This thread has been marked as answered and Intel will no longer monitor this thread. If you want a response from Intel in a follow-up question, please open a new thread.