The latest security information on Intel® products.

Intel® SGX Attestation Technical Details

One way to help ensure that Intel® SGX platforms have been appropriately updated is through the process of attestation. Attestation is the process of demonstrating that a software executable has been properly instantiated on a platform. Attestation allows a remote party to gain confidence that the intended software is securely running within an enclave on a fully patched, Intel SGX enabled platform.

The Intel SGX Trusted Computing Base (TCB) is comprised of the components in the platform that are required to implement the Intel SGX security objectives. Some of these components can be updated through a change in Intel SGX Platform Software, some via CPU firmware (that co-implements the Intel SGX instruction set along with the hardware), while other elements – such as the CPU logic – are immutable. Intel performs TCB Recovery operations to enable parties utilizing Intel SGX to determine whether updates for vulnerabilities have been applied on the platform from which attestation requests originate. Even with updates for vulnerabilities applied, an attestation may not result in an “UpToDate” response. This is because even up to date platforms may support different configurations, and these configurations may not be equivalent from a security standpoint. This applies whether the Intel Attestation Service (IAS) or the Intel® Software Guard Extensions Provisioning Certificate Service (Intel® SGX Provisioning Certification Service) is used. See Table 1 below for details.

For details on the IAS API and the PCS API, please refer to the IAS API Specification and the PCS API Specification, respectively. Additionally, further TCB Recovery Guidance for developers is available.

*In cases where more than one security advisory applies to the attesting platform, the attestation response may be CONFIGURATION_AND_SW_HARDENING_NEEDED.

** In cases where more than one security advisory applies to the attesting platform, the attestation response may be ConfigurationAndSWHardeningNeeded. In cases where one applies and the platform is also out of date, the tcbStatus may be OutOfDateConfigurationNeeded.

*** Intel IAS can’t assess whether the attesting enclave has the necessary SW mitigations and Intel PCS doesn’t provide attestation collateral that allows assessment of whether the attesting enclave has the necessary SW mitigations.

Implementing a Grace Period for Attestations

Depending on the Intel SGX-supported platform, there are different service mechanisms available to complete a remote attestation. As a reminder, a remote attestation is where the client’s quote is signed based on a known Trusted Compute Base and the relying party uses this quote to determine a client’s security patching status (ex: current as of a certain date, out of date, or current but running with a sub-optimal security configuration). 

When a TCB recovery occurs and is enforced, immediately having the attestation status change to “out of date” could potentially deny service to a large percentage of a relying party’s user base running on platforms that haven’t been updated. Implementing a grace period for the various services gives the user base time to update before they are declared “out of date”. 

For more information on grace periods, please reference the "Remote Attestation" and "Guidance to Infrastructure Partners" sections in the Trusted Computing Base Recovery of Intel Trusted Execution Environments technical paper.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries.  Other names and brands may be claimed as the property of others.  

Intel technologies may require enabled hardware, software or service activation.  No product or component can be absolutely secure.  Your costs and results may vary.