Question about PCE and PCCS.

[André_B]

Hi,

been researching Intel SGX as a part of my master's thesis project. I would greatly appreciate some clarifications regarding the PCE and PCCS. The setup uses ECSDA-based attestation in a data-center like environment. It's helpful if I figure out to what extent the entire system can be offline. The PCCS has support for offline caching, with manual administration. Verification, from what I understand, is possible to do only with PCCS and helpful libraries. However, I'm uncertain about the PCE at first launch/deployment, and if it needs to consult Intel directly or not. Been difficult to find clear documentation about it.

Question. Can the PCE retrieve the attestation collateral directly from PCCS, rather from Intel directly?

If you can think of other obstacles to making the system offline that you think I've missed, please share them.

Thanks for your help! 

[Sahira_Intel · Accepted solution]

Hi,

Intel does provide a reference caching service for Intel SGX PCS. The CSP or datacenter is expected to modify the ref to work within their infrastructure. The main limitation is that it requires runtime access to the internet to acquire the PCK certificate from the SGX PCS - so it does not support APIs to retrieve PCK certificates at deployment time.

You will find more useful information on the DCAP Product Brief: https://www.intel.com/content/dam/develop/public/us/en/documents/intel-sgx-dcap-ecdsa-orientation.pdf

Sincerely,

Sahira R.