Intel® Software Guard Extensions (Intel® SGX)
Discussion board focused on hardware-based isolation and memory encryption to provide extended code protection in solutions.

EINT Token

SAM_R_2
Beginner
948 Views

Hi,

How to prepare the EINIT Token in SGX? Could you please explain in details?

-Thanks

0 Kudos
1 Solution
Surenthar_S_Intel
948 Views

Hi Sam,

In the SGX spec, Intel will need to provide an Intel-signed launch enclave to make SGX usable. This enclave will use EGETKEY to acquire the launch key for that processor and sign enclaves to allow them to run there. If that launch enclave isn't trying to enforce any particular policy about what enclaves can and can't run, it's actually a trivial piece of code. A basic launch enclave only requires user/enclave calling convention and an enclave CMAC implementation, both of which are simple and fundamental to any useful SGX implementation.

Thanks and Regards,
Surenthar Selvaraj

View solution in original post

0 Kudos
4 Replies
Surenthar_S_Intel
949 Views

Hi Sam,

In the SGX spec, Intel will need to provide an Intel-signed launch enclave to make SGX usable. This enclave will use EGETKEY to acquire the launch key for that processor and sign enclaves to allow them to run there. If that launch enclave isn't trying to enforce any particular policy about what enclaves can and can't run, it's actually a trivial piece of code. A basic launch enclave only requires user/enclave calling convention and an enclave CMAC implementation, both of which are simple and fundamental to any useful SGX implementation.

Thanks and Regards,
Surenthar Selvaraj

0 Kudos
SAM_R_2
Beginner
948 Views

Thanks for your detailed info....

0 Kudos
Ofir_W_
Beginner
948 Views

Hello Surenthar,

I in understand right, and after looking at the open source launch enclave provided in the SDK, the provided launch enclave makes sure the user enclave is signed with a white listed key. Is it possible for me to get a Intel-signed launch enclave that lets every enclave run? It would be extremely useful for me in order to run enclaves just on my machine, in non-debug mode.

Where can I get such Intel-signed allow-all launch enclave?

 

Thanks!

Ofir

0 Kudos
Surenthar_S_Intel
948 Views

Hi,

For testing remote attestation, Sandbox is available for testing purpose Goto : https://software.intel.com/formfill/sgx-onboardingThis link is available from the SGX landing zone (software.intel.com/sgx). Go to “Resource Library” and then select “Access Development Services” from the sidebar.

-Surenthar

0 Kudos
Reply