Proof of SGX unavailability

[user14]

I am working on an application where the clients use their SGX on their machines for strong security features. But the application also works if a client doesn't have SGX support. The issue here is, the untrusted code can always claim to the RP that this user doesn't support SGX even if a user has enabled Intel SGX. Is there a solution to this problem? Is there a way to provide proof of SGX unavailability to the RP.  

[Rodolfo_S_]

Hi,

I don't think there is a way to do that. In the SGX use case, the OS is considered not trusted. With that said, you have the means to make sure that your application is running securely inside of SGX enclaves when the application says it is, but the other way around is not possible (at least not in the SGX context).

You might be able to do what intended there by using another approach such as secure/trusted/measured boot, which would be able to provide proof that the SGX driver wasn't loaded into your system, but I believe that here wouldn't be the place to obtain further information about these other approaches.

Regards,
Rodolfo