Question about PCE and PCCS.

André_B — Wed, 18 May 2022 09:13:46 GMT

Hi,

been researching Intel SGX as a part of my master's thesis project. I would greatly appreciate some clarifications regarding the PCE and PCCS. The setup uses ECSDA-based attestation in a data-center like environment. It's helpful if I figure out to what extent the entire system can be offline. The PCCS has support for offline caching, with manual administration. Verification, from what I understand, is possible to do only with PCCS and helpful libraries. However, I'm uncertain about the PCE at first launch/deployment, and if it needs to consult Intel directly or not. Been difficult to find clear documentation about it.

Question. Can the PCE retrieve the attestation collateral directly from PCCS, rather from Intel directly?

If you can think of other obstacles to making the system offline that you think I've missed, please share them.

Thanks for your help!

Re:Question about PCE and PCCS.

Sahira_Intel — Wed, 18 May 2022 23:16:37 GMT

Hi,

Intel does provide a reference caching service for Intel SGX PCS. The CSP or datacenter is expected to modify the ref to work within their infrastructure. The main limitation is that it requires runtime access to the internet to acquire the PCK certificate from the SGX PCS - so it does not support APIs to retrieve PCK certificates at deployment time.

You will find more useful information on the DCAP Product Brief: https://www.intel.com/content/dam/develop/public/us/en/documents/intel-sgx-dcap-ecdsa-orientation.pdf

Sincerely,

Sahira R.

topic Re:Question about PCE and PCCS. in Intel® Software Guard Extensions (Intel® SGX)

Question about PCE and PCCS.

Re:Question about PCE and PCCS.