intel sgx secure channel

[maxdd]

I am wondering is there any example showing how to build up a secure channel and communicate between client and enclave?

I find "https://github.com/cloud-security-research/sgx-ra-tls", but it only provides example code to attest the server using openssl-client. I am wondering if there is a more detailed example or a simple API that I can use.

Thanks!

[JesusG_Intel]

Hello maxdd,

Which client are you wondering about?

An enclave can only communicate with the untrusted application that it is compiled with, and this communication happens only inside the platform using SGX technology, ecalls and ocalls.

Enclaves cannot communicate directly with any other application outside of the untrusted application that calls it. All communication "with an enclave" is really happening between the outside entity and the untrusted application. Even other applications that run on the same system have to communicate with the untrusted application.

The secure channel, TLS, has to be established between the outside application and the untrusted application. See Figures 2 and 3 here: https://www.intel.com/content/www/us/en/developer/articles/code-sample/software-guard-extensions-remote-attestation-end-to-end-example.html

Sincerely,

Jesus G.

Intel Customer Support

[maxdd]

I use the incorrect the word. I should say how to build up a secure channel between enclave on server S1 and another application running on server S2 based on remote attestation.

I have seen the link in your post and the github repo 'https://github.com/intel/sgx-ra-sample#build-linux'. I am wondering if there is any clean and simple API or example that I can use directly.

Thanks!

[JesusG_Intel · Accepted solution]

Hello maxdd,

The answer remains the same. You should build a secure channel between the untrusted application on server S1 and the application on server S2. Since this secure communication is between two applications on two separate servers, this has nothing to do with SGX.

We do not provide examples of how to do this, but a TLS channel is one option. There are many APIs on secure communications between two applications. Just focus on the two regular applications and forget the enclave. The untrusted application is just like a regular application.

[JesusG_Intel]

Hello maxdd,

Did you see this discussion? https://github.com/redis/redis/pull/4855/ "SSL implementation on all channels"

[JesusG_Intel]

This thread has been marked as answered and Intel will no longer monitor this thread. If you want a response from Intel in a follow-up question, please open a new thread.