SGX Seal key for attestation

[dankoetfman]

Hello everyone,

I have a question regarding attestation key generation. The question is based for In this paper:

[PDF] Supporting Third Party Attestation for Intel® SGX with Intel® Data Center Attestation Primitives | Semantic Scholar

It is said that the Attestation key is derived from the Seal key of the Enclave. Is this key (Seal Key) derived from Root Sealing Key or is the Seal Key the same as the Root Sealing Key?

Best regards,
Danko

[Sahira_Intel · Accepted solution]

Hi Danko,

Sealing keys are derived from Root Sealing Keys (RSK). Root Sealing Keys are randomly generated and burned into e-fuses in processors during the manufacturing process. All residues of this key are erased so that each platform can assume that its RSK is unique.

Sincerely,

Sahira

[dankoetfman]

Hi Sahira,

Thanks, that is what I was searching for.

All the best,

Danko