Dear Intel,
For the application we are developing, we need to use SGX in a closed environment. That is, the system running the enclave will run on an air-gapped network with no connection to the internet, and as such can never run remote attestation. In this scenario it is our understanding that FLC is the only thing that can allow us to run in release mode.
However, the BIOS support needed to enable FLC is very rare, and we haven’t been able to find a platform with FLC that is suitable for us. Ideally, we want to use two COTS platforms, a very small headless machine like a NUC, and a laptop. So far we have only found one outdated NUC platform that supports FLC, and no laptop.
Does Intel have a plan to address this problem, for instance by advocating or making it easier for third party BIOS vendors (and Intel’s own NUC department) to incorporate FLC in the BIOS so that FLC support becomes more widespread, or will FLC forever be limited to specialized server platforms? Does any method exist that allows for configuring FLC without support in the BIOS?
We have looked into various ways to incorporate DCAP, but it will add a lot of extra infrastructure and make the project more expensive. We also considered running in pre-release mode and adding some security measures on our own, but now it is our understanding that pre-release runs with the debug flag on, so that is not an option.
