About Sealing

[ffan01]

Hi,

Is there any difference between the sgx_aes_ctr_encrypt and sgx_seal_data?

Since they are both used to encrypt the data, and I have tested their performance. They show similar performance.

Is there any suggestion to choose which encrypt function when I need to encrypt data?

Thanks!

[Scott_R_Intel]

Hello.

It really depends on the usage.  In simplest terms, the sgx_seal_data function requests via EGETKEY the processor seal key to encrypt the data, which is processor specific.  This means you would only be able to decrypt the data on that exact processor.  The sgx_aes_ctr_encrypt function takes the key to encrypt with as an input parameter, which could be the seal key if you wanted, or some other derived key.  Both functions ultimately encrypt with a 128bit AES key.  Also be aware that sgx_seal_data ultimately uses AES GCM and sgx_aes_ctr_encrypt uses AES CTR (of course, per the name), if that matters to your work.

Regards.

Scott