I would like to be able to verify the signature of a Quote. I have looked into the sdk and on different online resoucers, and the verification seems quite complex, if not impossible. I assume that once I have obtained EPID signature, I can use the ISK public key to verify it. Unfortunately it appears that the EPID signature is encrypted with quite a complex and undocumented process. If this unofficial docs are correct, https://github.com/kudelskisecurity/sgxfun/blob/master/GETQUOTE.md, then the (symmetric) encryption key used to encrypt the EPID signature is encrypted itself using an RSA_OAEP_256 encryption algorithm. But how is this RSA-2048 key generated?
Is it actually possible to indipendently verify the signature of a quote or it is something that only Intel can do?
That document is not sufficient. There is no mention on how to actually perform the EPID signature verification, since the signature I am seeing is encrypted. I saw on another document that "EPID name based (NB) Quotes only leave the platform encrypted with an Intel public key". Does it mean that the Random Based Quotes are not encrypted and therefore verifiable with the EPID group public key? I am currently using Name Base/Linkable Quotes.
I see. I am a bit disappointed and surprised, since in the documentation more than once there are hints to a possible open EPID verification, although without details.
Is it in the plan to support it in the foreseable future? The Intel Attestation Service is not sufficient for my needs, since the signed Attestation Report it returns cannot be linked in any way to the quote I am sending to IAS.