Visible to Intel only — GUID: GUID-03550E1D-84F0-490A-99FD-BFB3127628D9
For API Level 1 - Intel® ME 7.x - Sandy Bridge
For API Level 1.1 - Intel® ME 8.x lite - Sandy Bridge
For API Level 2 - Intel® ME 8.0 - Ivy Bridge
For API Level 3 - Intel® ME 8.1 - Ivy Bridge
For API Level 3 - SEC1.0, SEC1.1, SEC1.2, SEC2.0
For API Level 4 - Intel® ME 9.5, Intel ME 9.5.55 - Haswell
For API Level 4 - Intel® ME 9.1, Intel ME 9.1.35 - Haswell
For API Level 5 - Intel® ME 10.0.0 - Haswell
For API Level 6 - Intel® ME 10.0.20 - Broadwell
For API Level 7 - ME 11.0 - Skylake_LP and Skylake_H
For API Level 8 - TXE3.0 - Broxton, ME 11.5/11.8 - Kabylake_LP, Kabylake_H
For API Level 9 - Intel® ME 12.0 - Cannon Lake
Trusted Application Validation Guidelines
Validating the Manifest
Memory and Performance
Error Handling and Recovery
Functional Validation and Multi-Instance Support
Pack and DALP Generation and Validation
Host-Side Software Validation Guidelines
Trusted Application Management Flows
Error Handling and Recovery Flows
Multi-Instance and Interoperability Testing of Trusted Application Management
General and Platform-Related Events
End-to-End and Setup Validation Guidelines
Cross Trusted Application Interoperability Functional Testing
Creating a New Project
Importing an Existing Project
Converting an Existing Project
Building and Packaging Your Project and Running in Emulated Environment
Running Your Project
Running and Testing on Emulation and on Silicon
Debugging Trusted Applications
Preparing and Submitting Your Project for Signing
Signing an Applet
Signing New Versions
Visible to Intel only — GUID: GUID-03550E1D-84F0-490A-99FD-BFB3127628D9
Signing Process
The Intel® DAL Pack Tool signs on ACPs using a pre-production key which limits the usage of the ACPs to emulator and pre-production platforms only.
Pre-production platforms are not available to customers; they are available only inside Intel.
In order to load an Install Security Domain ACP in a production environment, the S-SD ACP must be signed by Intel.
The signing process is described below:
- OEM submits a Security Domain signing request to the relevant Intel business unit. The signing request includes the following:
- Security Domain manifest file
- Signature parameters file
- Signing Request form. To download a template, click here
- Intel reviews the request, creates the final Install Security Domain ACP to be signed, and performs basic installation tests on a pre-production platform.
- Intel signs on the Install Security Domain ACP with the production key and performs basic installation tests on a production platform.
- Intel completes validation/audit on the production signed binary ACP and the hash value of the OEM public key.
- The Intel business unit delivers the production signed binary ACP and the hash value of the OEM public key to the OEM.