question about sealing policy

[riclee]

as I know , there is two sealing policy ,sealing to mrenclave or mrsigner. the sealing key is derived by root sealing key. If I seal data on one processor, I can not unseal the encrypted data on another processor.(read the link: https://community.intel.com/t5/Intel-Software-Guard-Extensions/Question-about-Sealing/m-p/1062514 ), I don`t know what is the usage about this two sealing policy(to mrenclave or mrsigner), the encrypted data can not be migrated to other platform, if I use my own key to encrypt data, I can decrypt it on the other machine, but this two sealing policy can only encrypt and decrypt data on one platform, what is the meaning ?

And , another question , we can use sgx_rijndael128GCM_encrypt which is sgx sdk's API  to encrypt data by our own key, what is the difference if I use my own method to encrypt data by my own key in enclave .

[Iffa_Intel]

Hi,

The advantages of using the Intel SGX Sealing methods compared to others are, they are validated by Intel to be secure, as they are designed and tested to leverage established cryptographic algorithms and best practices.

Sealing methods like MRENCLAVE and MRSIGNER provide mechanisms to detect tampering in a compatible system.

Besides, SGX sealing methods leverage the hardware-based security features of SGX, especially for supported hardware.

These are some additional information regarding Intel SGX sealing policy:

1. Introduction to Intel® SGX Sealing
2. Intel SGX Sealing

Cordially,

Iffa

[Iffa_Intel]

Hi,

Intel will no longer monitor this thread since we have provided a solution. If you need any additional information from Intel, please submit a new question.

Cordially,

Iffa