Intel SGX root key

[RealArssal]

I am building an App that uses Intel SGX to sign a certain type of activities the app performs. Within a Secure Enclave I generate a statement X of the Kind "Operation A was performed with results B". Next, I generate a one-time key Y to sign this statement. The key X itself is a part of an SGX quote, i.e., is signed with the chain of keys (K1, K2, ...) provided by SGX technology. This chain terminates at the so called Intel SGX Root Key (R).

R -> K1 -> K2 -> ... -> Y -> X ("operation = A ; result = B")

I want to store statement X somewhere else such that 1 year later anyone would be able to verify that indeed an operation A was performed with result B. In this case, the verifier would unwind the chain of trust starting from the Intel SGX Root Key (R) until they reach my one-time key Y, and finally verify the statement X.

The question is, where do I get the key R from?

When we deal with this type of cryptographic schemes, the ultimate key to trust is somewhere in the public, e.g., on one of the main pages of Intel's website. However, it is kind of challenging to find it. Any idea where one could obtain it from?

[Sahira_Intel · Accepted solution]

Hi,

The root key is a component of the Root CA Cert and can be extracted from it.  We have hard coded links now in the API Docs to the Root CA Certs just above where this link lands you.

Look for:

“Download the Provisioning Certification Root CA Certificate for API v3 here:
DER PEM (fingerprint: 8bd31eb1d63ce37382c0ffaa0d8200a3011ad6ff)”

Hope this is helpful

Sincerely,

Sahira