Hi Intel SGX team,
As of now, SGX enclaves are signed using RSA3072 with PKCS#1 V1.5 padding. However, PKCS#1 v1.5 is known to have certain cryptographic vulnerabilities, particularly in the context of signature forgery and padding oracle attacks, and is generally discouraged in favor of more secure alternatives such as RSASSA-PSS and thus has been deprecated in many companies for security concerns.
Given the growing emphasis on modern cryptographic standards and best practices, I would like to ask:
Are there any plans to migrate the enclave signing scheme to a more secure padding method such as RSASSA-PSS or another recommended standard? If so, is there a roadmap or timeline for this transition?
I appreciate your insights and any guidance you can provide on this matter.
Here is the description of the enclave signing key from P21 of Intel® Software Guard Extensions Developer Reference for Linux* OS
"The signature should follow the RSAPKCS1.5 padding scheme. The signature should be generated using the v1.5 version of the RSA scheme with
an SHA-256 message digest."
Thank you!
