Intel® Software Guard Extensions (Intel® SGX)
Discussion board focused on hardware-based isolation and memory encryption to provide extended code protection in solutions.

Sealing with MRSIGNER

Elephant
초급자
826 조회수

Hi,

I am currently doing a Sealing experiment.  When I seal some chunk of data on one machine with an enclave signed with SIGNA.pem, will I be able to unseal it on another machine with the same enclave code signed with SIGNA.pem too?

It returns the following error: SGX_ERROR_INVALID_CPUSVN.  Why is this so?  Is this the expected result given the scenario above?

Thanks!

Kind Regards,
Elephant

 

 

0 포인트
2 응답
Hoang_N_Intel
직원
826 조회수

The unsealing process must be done in the same system because the sealed data is encrypted in the enclave, using the encryption key that is derived from the CPU specific to that system.

For more information about sealing, please watch this video https://software.intel.com/en-us/videos/how-to-seal-data-in-intel-sgx

0 포인트
you_w_
새로운 기여자 III
826 조회수

The Sealing key is derived from both MRSIGNER and Platform information, Thus you can only unseal it on a same  platform.

Regards,

you

0 포인트
응답