Intel® Software Guard Extensions (Intel® SGX)
Discussion board focused on hardware-based isolation and memory encryption to provide extended code protection in solutions.
1401 Discussions

Load my certificate and private key into the enclave safely

Ícaro_Lima
Beginner
‎12-21-2018 10:56 AM
267 Views

Hello, I have a SGX application that attests and communicates via HTTPS. One major problem I encountered is that I can not safely load my certificate and my key into the enclave. I thought about leaving a hardcoded key that decrypts the certificate and key, and I would use it myself to encrypt it from the outside. As discussed earlier (https://software.intel.com/en-us/forums/intel-software-guard-extensions-intel-sgx/topic/738239), it is possible for someone to get sensitive data encoded within the enclave.

Suggestions?

0 Kudos

Link Copied

1 Reply
Scott_R_Intel
Employee
‎01-03-2019 11:50 AM
267 Views

Hello Ícaro.

To be able to securely provision data (ie. keys, certificates, etc) to your enclave, you need to use SGX remote attestation.  Once you successfully attest that your enclave is running on a remote system, you can send the data you'd like in a secure fashion to it.

For more information, see this link:  https://software.intel.com/en-us/articles/code-sample-intel-software-guard-extensions-remote-attestation-end-to-end-example

Regards.

Scott

0 Kudos
Copy link
Reply

Community support is provided during standard business hours (Monday to Friday 7AM - 5PM PST). Other contact methods are available here.

Intel does not verify all solutions, including but not limited to any file transfers that may appear in this community. Accordingly, Intel disclaims all express and implied warranties, including without limitation, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement, as well as any warranty arising from course of performance, course of dealing, or usage in trade.

For more complete information about compiler optimizations, see our Optimization Notice.