Intel White Paper: Intel® SGX and Intel® EPID Provisioning and Attestation Service

Intel® Software Guard Extensions: EPID Provisioning and Attestation Services

Simon Johnson, Vinnie Scarlata, Carlos Rozas, Ernie Brickell, Frank Mckeen

Intel Corporation

{ simon.p.johnson, vincent.r.scarlata, carlos.v.rozas, ernie.brickell, frank.mckeen }@intel.com

Section 2 provides a high level overview of how ABSTRACT initial implementations of Intel® SGX provide a recovery mechanism that allows the platform to be

Intel® Software Guard Extensions (SGX) has an

updated, and attest to this update.

attestation capability that can be used to remotely

Section 3 outlines the Intel® Enhanced Privacy

provision secrets to an enclave. Use of Intel® SGX

Identifier (EPID) architecture used to support Intel®

attestation and sealing has been described in [1]. This

SGX architecture. EPID is the algorithm of choice for

paper describes how the SGX attestation key are

SGX attestations.

remotely provisioned to Intel® SGX enabled

Section 4 details the provisioning and

platforms, the hardware primitives used to support

attestation verification services Intel has established

the process, and the Intel Verification Service that

to support SGX.

simplifies the verification of an SGX attestation. The

1.1 Attestation Primer

paper also includes a short primer on the Intel®

Enhanced Privacy Identifier which is signature Attestation is the process of demonstrating that a algorithm used by Intel® SGX attestation architecture. software executable has been properly instantiated on a platform. The Intel® SGX attestation allows a remote party to gain confidence that the intended

1 Introduction

software is securely running within an enclave on an

Intel® SGX is a set of processor extensions for

Intel® SGX enabled platform. The attestation conveys

establishing a protected execution environment

the following information in an assertion:

inside an application [2]. This execution environment

 Identities of software being attested.

is called an enclave. SGX enclaves are created without

 Details of unmeasured state (e.g. the mode

secrets. Secrets are delivered after the enclave has

software is running in).

been instantiated on the platform. The process of

 Data which software associates with itself.

proving that the enclave has been established in a

SGX uses an asymmetric attestation key,

secure hardware environment is referred to as remote

representing the SGX TCB, to sign an assertion with

attestation. To perform an attestation the platform

the information listed above.

must have access to an attestation key. In [1] Intel outlined an architecture for how the platform produces the attestation but did not outline how the

attestation key was delivered to the platform. It also Application

Enclave Application Challenger

did not outline the responsibilities of a relying party

User Data

when verifying the attestations.

User Platform

This paper outlines the services infrastructure Intel has constructed to support the initial Quoting

Attestation

Enclave

implementations of the Intel® SGX technology. In Verification

Attestation Key

Section 1, we recap the attestation flow outlined in [1] and identify requirements for a corresponding attestation key provisioning architecture. In particular, Figure 1: Attestation Flow we highlight the need for recovery mechanism when the Trusted Computing Base (TCB) is modified.