Verify EPID Signature

[Ernesto_F_]

Hi,

I would like to be able to verify the signature of a Quote. I have looked into the sdk and on different online resoucers, and the verification seems quite complex, if not impossible. I assume that once I have obtained EPID signature, I can use the ISK public key to verify it. Unfortunately it appears that the EPID signature is encrypted with quite a complex and undocumented process. If this unofficial docs are correct, https://github.com/kudelskisecurity/sgxfun/blob/master/GETQUOTE.md, then the (symmetric) encryption key used to encrypt the EPID signature is encrypted itself using an RSA_OAEP_256 encryption algorithm. But how is this RSA-2048 key generated? 

Is it actually possible to indipendently verify the signature of a quote or it is something that only Intel can do?

Kind Regards

[Surenthar_S_Intel]

Please go through the below link for your reference

https://software.intel.com/en-us/blogs/2016/03/09/intel-sgx-epid-provisioning-and-attestation-services

-Surenthar

[Ernesto_F_]

That document is not sufficient. There is no mention on how to actually perform the EPID signature verification, since the signature I am seeing is encrypted. I saw on another document that "EPID name based (NB) Quotes only leave the platform encrypted with an Intel public key". Does it mean that the Random Based Quotes are not encrypted and therefore verifiable with the EPID group public key? I am currently using Name Base/Linkable Quotes.

[Surenthar_S_Intel]

Intel is not currently supporting 3rd party attestation verifications of EPID signatures for either Linkable or unlinkable.

-Surenthar.

[Ernesto_F_]

I see. I am a bit disappointed and surprised, since in the documentation more than once there are hints to a possible open EPID verification, although without details.

 Is it in the plan to support it in the foreseable future?  The Intel Attestation Service is not sufficient for my needs, since the signed Attestation Report it returns cannot be linked in any way to the quote I am sending to IAS.

[Kirchengast__Felix]

I have the same question in 2018...

Is there any documentation on how to perform the EPID signature verification using the IAS group public key?