topic @Rodolfo in Intel® Software Guard Extensions (Intel® SGX)

How is enclave created remotely

M_A_2 — Thu, 06 Apr 2017 18:15:40 GMT

Hi,

I am learning SGX and wanted to know how is an enclave is created in a remote machine. As I understood, the enclave should be created locally and should be measured to get MRENCLAVE. Then it should be created in the remote machine and when attested, it should return the same value of MRENCLAVE, right?.

Can we send code and data to the enclave in the remote machine encrypted? if yes, how please? and what will be the value of MRENCLAVE obtained from the remote machine?

Thanks

Hi.

Rodolfo_S_ — Thu, 06 Apr 2017 23:51:58 GMT

Hi.

You are correct. If the exact same enclave is loaded in two different machines, their MRENCLAVE's will match.

As a result of the remote attestation process, which is well defined here, a symmetric key is derived, and this key can be used to send encrypted data to/from the enclave. The MRENCLAVE will not change after the enclave loading is completed. SGX1 does not support dynamic changes to enclave code.

M_A_2 — Fri, 07 Apr 2017 05:51:54 GMT

This means that the code has to be in the remote machine in plaintext to create the enclave in the remote machine?

Yes, the initial state of an

AArya2 — Fri, 07 Apr 2017 16:38:55 GMT

Yes, the initial state of an enclave is always out in the open.

@Rodolfo

AArya2 — Mon, 10 Apr 2017 12:28:21 GMT

@Rodolfo

Does SGX2 support dynamic changes to enclave code?