BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Appendix C Intel In-Use Secret Key Protection Implementation 485

NIST platform security: roots of trust, firmware and secure enclaves IR 8320D (Draft)
All changes in this version
first version loaded Appendix C Intel In-Use Secret Key Protection Implementation 485

Title

Intel In-Use Secret Key Protection Implementation 485

Control

This appendix contains supplementary information describing the components and the steps 486 needed to set up the prototype implementation for enabling hardware components for Intel-based 487 confidential computing. 488 The prototype uses Intel SGX as the confidential computing technology to help protect secret 489 keys in-use. Intel SGX uses hardware-based memory encryption to isolate specific application 490 code and data in memory. Intel SGX allows user-level code and data to run in private regions of 491 memory, called enclaves (Intel SGX enclaves are TEEs). Enclaves are designed to be protected 492 from other workloads, including those running at higher privilege levels. Intel SGX enclaves are 493 loaded by workloads as shared libraries. The communication between a workload and an Intel 494 SGX enclave uses dedicated Intel instructions called eCalls. The Intel SGX enclave can invoke 495 external code using dedicated Intel instructions called oCalls. Fig. 6 shows the isolation of Intel 496 SGX enclaves in a host. 497

Fig. 6. Intel SGX Enclave 498

Intel SGX attestation allows a remote relying party to verify that an SGX enclave is genuine. 499 This is achieved by generating enclave attributes using the Intel SGX software development kit 500 (SDK) during the enclave build time. Intel SGX attributes include the enclave signer 501 (MRSigner), the measurement (MREnclave, a fingerprint of the enclave code and initial data), 502 and the ID. At runtime, a remote-relying party can request the generation of evidence (called a 503 quote in Intel SGX) containing these same attributes and compare them against those generated 504 by the SDK. An Intel SGX quote also contains the patch levels of the firmware and the Intel 505 SGX supporting software, which the relying party can use to determine if the Intel SGX enclave 506 can be trusted. An Intel SGX quote also contains any data that the enclave wants to share with 507 the relying party. Intel SGX quotes are signed by a verifiable Intel key, so the relying party has 508 the assurance that the attributes’ values are authentic. 509 To enable the remote attestation of Intel SGX enclaves, the host must register to Intel online 510 services and get provisioned with an Intel SGX signing certificate called a provisioning 511 certification key (PCK) certificate . This must be completed before Intel SGX enclaves are loaded 512 on the host. 513 Intel Secure Key Caching (SKC) is an implementation of the private key protection in-use using 514 Intel SGX. SKC is a library that wraps an implementation of the PKCS#11 (Public Key 515 Cryptography Standards) interface in an Intel SGX enclave. When a workload requests a key via 516 its PKCS#11 URI, SKC retrieves the key from a remote key management system (KMS) after 517 attestation. Intel SKC is open source: https://github.com/intel- 518 secl/docs/blob/master/README.md#secure-key-caching . 519 The prototype has been implemented using an Intel Mehlow (E3) Server procured from 520 Supermicro, which is Intel SGX-enabled. The following steps illustrate how to enable SGX on 521 the Supermicro Mehlow server in the BIOS: 522