Intel® Software Guard Extensions (Intel® SGX)
Use hardware-based isolation and memory encryption to provide more code protection in your solutions.

EINT Token

SAM_R_2
Beginner
297 Views

Hi,

How to prepare the EINIT Token in SGX? Could you please explain in details?

-Thanks

0 Kudos
1 Solution
Surenthar_S_Intel
297 Views

Hi Sam,

In the SGX spec, Intel will need to provide an Intel-signed launch enclave to make SGX usable. This enclave will use EGETKEY to acquire the launch key for that processor and sign enclaves to allow them to run there. If that launch enclave isn't trying to enforce any particular policy about what enclaves can and can't run, it's actually a trivial piece of code. A basic launch enclave only requires user/enclave calling convention and an enclave CMAC implementation, both of which are simple and fundamental to any useful SGX implementation.

Thanks and Regards,
Surenthar Selvaraj

View solution in original post

4 Replies
Surenthar_S_Intel
298 Views

Hi Sam,

In the SGX spec, Intel will need to provide an Intel-signed launch enclave to make SGX usable. This enclave will use EGETKEY to acquire the launch key for that processor and sign enclaves to allow them to run there. If that launch enclave isn't trying to enforce any particular policy about what enclaves can and can't run, it's actually a trivial piece of code. A basic launch enclave only requires user/enclave calling convention and an enclave CMAC implementation, both of which are simple and fundamental to any useful SGX implementation.

Thanks and Regards,
Surenthar Selvaraj

SAM_R_2
Beginner
297 Views

Thanks for your detailed info....

Ofir_W_
Beginner
297 Views

Hello Surenthar,

I in understand right, and after looking at the open source launch enclave provided in the SDK, the provided launch enclave makes sure the user enclave is signed with a white listed key. Is it possible for me to get a Intel-signed launch enclave that lets every enclave run? It would be extremely useful for me in order to run enclaves just on my machine, in non-debug mode.

Where can I get such Intel-signed allow-all launch enclave?

 

Thanks!

Ofir

Surenthar_S_Intel
297 Views

Hi,

For testing remote attestation, Sandbox is available for testing purpose Goto : https://software.intel.com/formfill/sgx-onboardingThis link is available from the SGX landing zone (software.intel.com/sgx). Go to “Resource Library” and then select “Access Development Services” from the sidebar.

-Surenthar

Reply