Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Alon_J_
Beginner
250 Views

Initial SGX provisioning

Jump to solution

 

1. Do all SGX-platforms come pre-provisioned with an attestation key?

2. Is provisioning an OEM's responsibility?

3. In case the platform has not been provisioned, the attestation key is lost or in case the attestation key is out of date, How can I conduct the provisioning process to obtain a fresh EPID private key? 

0 Kudos
1 Solution
Derek_B_Intel
Employee
250 Views

SGX platforms are not pre-provisioned.

Provisioning is triggered as part of the attestation process.  When a SGX client application connects to the application server for the first time, the application server will trigger a challenge to the client to attest (running on a valid SGX client machine as well as verifying the validity of enclave running on the client).

The SGX Platform Software (PSW) running on the client machine will receive a request to generate a quote for the application enclave.  At this point, the PSW detects whether EPID provisioning has occurred and if not, triggers the EPID provisioning process.

In summary, the SGX PSW is responsible for EPID provisioning which is triggered as a result of the 1st attestation on that platform.

View solution in original post

1 Reply
Derek_B_Intel
Employee
251 Views

SGX platforms are not pre-provisioned.

Provisioning is triggered as part of the attestation process.  When a SGX client application connects to the application server for the first time, the application server will trigger a challenge to the client to attest (running on a valid SGX client machine as well as verifying the validity of enclave running on the client).

The SGX Platform Software (PSW) running on the client machine will receive a request to generate a quote for the application enclave.  At this point, the PSW detects whether EPID provisioning has occurred and if not, triggers the EPID provisioning process.

In summary, the SGX PSW is responsible for EPID provisioning which is triggered as a result of the 1st attestation on that platform.

View solution in original post

Reply