topic Re:question about sealing policy in Intel® Software Guard Extensions (Intel® SGX)

question about sealing policy

riclee — Sat, 07 Oct 2023 07:33:12 GMT

as I know , there is two sealing policy ,sealing to mrenclave or mrsigner. the sealing key is derived by root sealing key. If I seal data on one processor, I can not unseal the encrypted data on another processor.(read the link: https://community.intel.com/t5/Intel-Software-Guard-Extensions/Question-about-Sealing/m-p/1062514 ), I don`t know what is the usage about this two sealing policy(to mrenclave or mrsigner), the encrypted data can not be migrated to other platform, if I use my own key to encrypt data, I can decrypt it on the other machine, but this two sealing policy can only encrypt and decrypt data on one platform, what is the meaning ?

And , another question , we can use sgx_rijndael128GCM_encrypt which is sgx sdk's API to encrypt data by our own key, what is the difference if I use my own method to encrypt data by my own key in enclave .

Re: question about sealing policy

Iffa_Intel — Thu, 12 Oct 2023 02:19:25 GMT

Hi,

The advantages of using the Intel SGX Sealing methods compared to others are, they are validated by Intel to be secure, as they are designed and tested to leverage established cryptographic algorithms and best practices.

Sealing methods like MRENCLAVE and MRSIGNER provide mechanisms to detect tampering in a compatible system.

Besides, SGX sealing methods leverage the hardware-based security features of SGX, especially for supported hardware.

These are some additional information regarding Intel SGX sealing policy:

Cordially,

Iffa

Re:question about sealing policy

Iffa_Intel — Wed, 18 Oct 2023 00:44:47 GMT

Hi,

Intel will no longer monitor this thread since we have provided a solution. If you need any additional information from Intel, please submit a new question.

Cordially,

Iffa