Initial SGX provisioning

Alon_J_ — Mon, 18 Apr 2016 08:42:38 GMT

1. Do all SGX-platforms come pre-provisioned with an attestation key?

2. Is provisioning an OEM's responsibility?

3. In case the platform has not been provisioned, the attestation key is lost or in case the attestation key is out of date, How can I conduct the provisioning process to obtain a fresh EPID private key?

SGX platforms are not pre

Derek_B_Intel — Mon, 18 Apr 2016 13:05:45 GMT

SGX platforms are not pre-provisioned.

Provisioning is triggered as part of the attestation process. When a SGX client application connects to the application server for the first time, the application server will trigger a challenge to the client to attest (running on a valid SGX client machine as well as verifying the validity of enclave running on the client).

The SGX Platform Software (PSW) running on the client machine will receive a request to generate a quote for the application enclave. At this point, the PSW detects whether EPID provisioning has occurred and if not, triggers the EPID provisioning process.

In summary, the SGX PSW is responsible for EPID provisioning which is triggered as a result of the 1st attestation on that platform.

topic SGX platforms are not pre in Intel® Software Guard Extensions (Intel® SGX)

Initial SGX provisioning

SGX platforms are not pre