Can the Service Provider be a SGX-disabled machine?

[li__caihua]

Hi everyone,

I learn that if the enclave contacts the service provider to have its sensitive data provisioned to the enclave, the SGX-enabled platform will send a secure assertion that identifies the hardware environment and the enclave to the service provider (called Attestation). Then when the service provider assesses the trustworthiness of the enclave, it uses the attestation to establish secure communication and provision sensitive data to the enclave (called Provisioning).

But I have a question. Can the service providers run on a SGX-disabled machine? (I am not so familiar with the attestation and how it establishes the secure communication)

If the answer is no, is there any way to get sensitive data from a service providers run on a SGX-disabled machine?

Many thanks!

Caihua

[you_w_]

Hi ：

Of cause yes. Service provider can be an sgx-disabled machine.You can look into this demo (https://software.intel.com/en-us/articles/intel-software-guard-extensions-remote-attestation-end-to-end-example) for more information. The secure communication channel is established by use a protocol named "sigma".

Regards 

you