Intel® Software Guard Extensions (Intel® SGX)
Use hardware-based isolation and memory encryption to provide more code protection in your solutions.

Memset-ing on enclaves

Elephant
Beginner
165 Views

hi,

I noticed on a lot of sgx code examples that they explicitly memset allocated variables to 0 before leaving the trusted zone. Any insight on this?  Ithought enclaves' EPC is protected and doing memsets will reduce performance of applications.

Thanks!

Kind Regards,

Elephant 

0 Kudos
1 Solution
Hoang_N_Intel
Employee
165 Views

The reason of using memset is documented in the SGX Developer Guide at https://download.01.org/intel-sgx/linux-1.9/docs/Intel_SGX_Developer_Guide.pdf under the section of "Disposal of Enclave Secrets".

Here is an excerpt: "The enclave writer must use the memset_s() function to clear any variable that contained secret data. The use of this function guarantees that the compiler will not optimize away the write to memory intended by this function call and thus ensuring the secret data is cleared. Using memset_s() is especially important when secret data is stored in a dynamically allocated buffer"

View solution in original post

1 Reply
Hoang_N_Intel
Employee
166 Views

The reason of using memset is documented in the SGX Developer Guide at https://download.01.org/intel-sgx/linux-1.9/docs/Intel_SGX_Developer_Guide.pdf under the section of "Disposal of Enclave Secrets".

Here is an excerpt: "The enclave writer must use the memset_s() function to clear any variable that contained secret data. The use of this function guarantees that the compiler will not optimize away the write to memory intended by this function call and thus ensuring the secret data is cleared. Using memset_s() is especially important when secret data is stored in a dynamically allocated buffer"

View solution in original post

Reply