topic Re:intel sgx secure channel in Intel® Software Guard Extensions (Intel® SGX)

intel sgx secure channel

maxdd — Tue, 08 Feb 2022 20:30:35 GMT

I am wondering is there any example showing how to build up a secure channel and communicate between client and enclave?

I find "https://github.com/cloud-security-research/sgx-ra-tls", but it only provides example code to attest the server using openssl-client. I am wondering if there is a more detailed example or a simple API that I can use.

Thanks!

Re:intel sgx secure channel

JesusG_Intel — Tue, 08 Feb 2022 21:01:24 GMT

Hello maxdd,

Which client are you wondering about?

An enclave can only communicate with the untrusted application that it is compiled with, and this communication happens only inside the platform using SGX technology, ecalls and ocalls.

Enclaves cannot communicate directly with any other application outside of the untrusted application that calls it. All communication "with an enclave" is really happening between the outside entity and the untrusted application. Even other applications that run on the same system have to communicate with the untrusted application.

The secure channel, TLS, has to be established between the outside application and the untrusted application. See Figures 2 and 3 here: https://www.intel.com/content/www/us/en/developer/articles/code-sample/software-guard-extensions-remote-attestation-end-to-end-example.html

Sincerely,

Jesus G.

Intel Customer Support

Re: intel sgx secure channel

maxdd — Tue, 08 Feb 2022 21:54:13 GMT

I use the incorrect the word. I should say how to build up a secure channel between enclave on server S1 and another application running on server S2 based on remote attestation.

I have seen the link in your post and the github repo 'https://github.com/intel/sgx-ra-sample#build-linux'. I am wondering if there is any clean and simple API or example that I can use directly.

Thanks!

Re:intel sgx secure channel

JesusG_Intel — Tue, 08 Feb 2022 22:04:03 GMT

Hello maxdd,

The answer remains the same. You should build a secure channel between the untrusted application on server S1 and the application on server S2. Since this secure communication is between two applications on two separate servers, this has nothing to do with SGX.

We do not provide examples of how to do this, but a TLS channel is one option. There are many APIs on secure communications between two applications. Just focus on the two regular applications and forget the enclave. The untrusted application is just like a regular application.

Re:intel sgx secure channel

JesusG_Intel — Thu, 10 Feb 2022 02:54:17 GMT

Hello maxdd,

Did you see this discussion? https://github.com/redis/redis/pull/4855/ "SSL implementation on all channels"

Re:intel sgx secure channel

JesusG_Intel — Fri, 18 Feb 2022 02:14:45 GMT

This thread has been marked as answered and Intel will no longer monitor this thread. If you want a response from Intel in a follow-up question, please open a new thread.