Intel® Software Guard Extensions (Intel® SGX)
Discussion board focused on hardware-based isolation and memory encryption to provide extended code protection in solutions.

SGX_ERROR_UNRECOGNIZED_PLATFORM on Ice Lake Xeon-SP

kss-fluency
Beginner
852 Views

I am developing a SGX-based solution, using a cloud vendor to deliver a SGX-capable machine. This machine has the driver, PSW & SDK installed and correct support for SGX1&SGX2 as per output from both cpuid | grep -i sgx and https://github.com/ayeks/SGX-hardware . The machine works a following CPU:

kss@fluency:~/linux-sgx$ cat /proc/cpuinfo  | grep 'name'| uniq
model name	: Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz

 

The https://github.com/intel/linux-sgx/tree/master/SampleCode/SampleEnclave works correctly in a HW mode. However, when performing an EPID Remote Attestation, an IAS server returns SGX_ERROR_UNRECOGNIZED_PLATFORM error. Same error is also being returned when a local Enclave quote is requested.

This came as a surprise, however surely enough, there is a little note in https://github.com/intel/linux-sgx/blob/master/README.md : 

Note: Ice Lake Xeon-SP (and the future Xeon-SP platforms) doesn't support EPID attestation.

This note seems to explain root of the issue, although it is directly contradicting output from both cpuid | grep -i sgx and https://github.com/ayeks/SGX-hardware  .

 

Performing an attestation is crucial to the solution I'm developing. ECDSA attestation could be an option (Ice Lake Xeons seem to support it) but it seems to be significantly more complex to develop. I am hoping to get a quick win with an EPID attestation instead.

 

Therefore the question is: what is the full list of CPUs supporting SGX2 and EPID attestation ? I would like to provide my cloud provider an exhaustive list like this, so that it's easier for him to provide a correct CPU.

 

Kind regards,

Kris

0 Kudos
1 Solution
KFPW_Intel
Moderator
828 Views

Hi Kris,


The SGX_ERROR_UNRECOGNIZED_PLATFORM error observed could be due to Intel EPID Provisioning failed. It is due to the platform was not recognized by the back-end server.


This article Which Platforms Support Intel Software Guard Extensions (Intel SGX) SGX2? can guide you on which CPUs support SGX2.


As for EPID support, all consumer CPUs and all Xeon E-xxxx CPUs that support SGX support EPID. However, our newest 3rd Generation Intel® Xeon® Scalable Processors (codename Ice Lake Server) and all future Scalables only support DCAP (no EPID support).


Regards,

Ken


View solution in original post

0 Kudos
3 Replies
KFPW_Intel
Moderator
829 Views

Hi Kris,


The SGX_ERROR_UNRECOGNIZED_PLATFORM error observed could be due to Intel EPID Provisioning failed. It is due to the platform was not recognized by the back-end server.


This article Which Platforms Support Intel Software Guard Extensions (Intel SGX) SGX2? can guide you on which CPUs support SGX2.


As for EPID support, all consumer CPUs and all Xeon E-xxxx CPUs that support SGX support EPID. However, our newest 3rd Generation Intel® Xeon® Scalable Processors (codename Ice Lake Server) and all future Scalables only support DCAP (no EPID support).


Regards,

Ken


0 Kudos
kss-fluency
Beginner
814 Views

Thanks for an answer.

 

May I ask what is the reasoning behind removing EPID support in all new SP processors? Is EPID Attestation expected to be discontinued in the future?

0 Kudos
KFPW_Intel
Moderator
803 Views

Hi Kris,

 

Data center customers and the ecosystem have moved toward ECDSA-based attestation, away from EPID, because it affords them more control, relying less on Intel infrastructure. Regarding the future of EPID attestation support, we cannot comment on future roadmaps.

 

Regards,

Ken

 

0 Kudos
Reply