- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, all,
We've tested the remote attestation sample code on 2 platforms available to us: Dell Poweredge R340 (CPU: Intel(R) Xeon(R) E-2174G), and Lenovo ThinkSystem SR250 Rack Server (CPU: Intel(R) Xeon(R) E-2288G). We've updated to the latest BIOS version from the OEM, and the latest microcode patches from: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files
However the remote attestation returns
---- Enclave Trust Status from Service Provider ----------------------------
Enclave Trust is TRUSTED and COMPLICATED. The client is out of date and
may not be trusted in the future depending on the service provider's policy.
A Platform Info Blob (PIB) was provided by the IAS
----------------------------------------------------------------------------
---- IAS Advisories --------------------------------------------------------
https://security-center.intel.com
INTEL-SA-00219,INTEL-SA-00289
---- ISV Enclave Trust Status ----------------------------------------------
Enclave TRUSTED and COMPLICATED - Reason: CONFIGURATION_NEEDED
A Platform Info Blob (PIB) was provided by the IAS
The microcode version is 0xca. The SGX SDK is the latest 2.9 version (as of 06/09/2020).
According to the OEM website (Lenovo):
https://datacentersupport.lenovo.com/us/en/product_security/home the INTEL-SA-00219 (CVE-2019-0117) and INTEL-SA-00289 (CVE-2019-11157) were fixed in LEN-29846 (UEFI: ISE114H) and LEN-27714 (UEFI: ISE112).
Perhaps, a TCB recovery is needed for the advisories (https://software.intel.com/sites/default/files/managed/01/7b/Intel-SGX-Trusted-Computing-Base-Recovery.pdf)? Is there any instructions on how to perform the TCB recovery?
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Yunfeng,
The backend team did some research and it turns out my previous response was correct. It has to do with being able to enable the overclocking lock bit, which your vendors did not implement. The only thing you can do is to contact them to implement this feature as described in Intel-SA-00289.
Link Copied
- « Previous
-
- 1
- 2
- Next »
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Yunfeng,
I apologize for the delay. Some key people have been out and are returning this week. I hope to have an answer for you this week.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Yunfeng,
The backend team did some research and it turns out my previous response was correct. It has to do with being able to enable the overclocking lock bit, which your vendors did not implement. The only thing you can do is to contact them to implement this feature as described in Intel-SA-00289.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, Jesus. We really appreciate your help on this.
Best,
Wenhao
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This thread has been marked as answered and Intel will no longer monitor this thread. If you want a response from Intel in a follow-up question, please open a new thread.
![](/skins/images/B7BA37F9CE4B52FF7CAE1FB0388839C8/responsive_peak/images/icon_anonymous_message.png)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- « Previous
-
- 1
- 2
- Next »