Licensee Guide
1-Sept-2016
Subject to Revision
Executive Summary
As an Intel SGX licensed developer (Licensee), your use of technology for Intel SGX is expected to comply with the following guidelines. These guidelines have been developed so that users of Intel SGX enabled software can make certain assumptions about the software they are relying upon. Failure to meet these guidelines can result in your license being terminated. Intel may update these guidelines from time to time without notice.
Terms used in this document
Licensee– the developer organization which has accepted the license conditions for Intel SGX.
Platform Software (PSW)– Software for Intel SGX, which includes but is not limited to: enclaves used for EPID provisioning, attestation, launching and platform services, that are required for the SGX architecture to work.
Software Development Kit (SDK)– Software for Intel SGX, used by a Licensee to create their own Intel SGX enabled application software.
Enclave Signing Key– A public/private key pair used by the Licensee to generate a signature over their software enclave in the form of a SIGSTRUCT.
Attestation Servicefor Intel SGX– A RESTful web service provided and operated by Intel which allows a Licensee to verify attestation evidence (enclave QUOTES) submitted by Service Providers
Production Attestation Service for Intel SGX– The production version of the Attestation Service, intended for business-relevant traffic. Access requires a signed Commercial Use License Agreement.
Development Attestation Servicefor Intel SGX– The test version (intended for test traffic and functional validation) of the Attestation Service. Does not require a signed Commercial Use License Agreement, but does require providing some basic configuration information to Intel. Customer traffic may be throttled, service level and availability may be lower than the Production Attestation Service.
Trusted Computing Base (TCB)– the critical parts of the platform that maintain the security of the Intel SGX enabled platform.
Secure SW Development Practices
For the most part software inside an enclave is just like any other software. To achieve optimal security it should be developed and validated with care. Placing your software in an Intel SGX protected environment does not relieve the need for a software developer to follow good development techniques and secure programming practices. Specific enclave development issues are highlighted in the Developer Guide for Intel SGX that accompanies the Software Development Kit for Intel SGX. In addition, Licensees should:
- Observe industry secure coding best practices for software development to avoid vulnerabilities (e.g., a secure software development framework, coding standards, data input validation, least access possible, secure logging, and so on).
- Address and fix significant security vulnerabilities within a reasonable time after becoming aware of the vulnerability.
- Ensure that the licensed application installer includes the Platform Software (PSW) Installer for Intel SGX.
- Ensure that end users receive PSW updates via application update mechanism.
- Observe best industry practices to: (i) not write malware, spyware or other nuisance software; (ii) not write poorly designed software that contains significant security vulnerabilities or that fails to deliver its security promise.
- Write their application code to minimize the Enclave memory footprint for Intel SGX. Do not stress the enclave memory space or consume an unreasonable amount of it, such that the enclave space or Services for Intel SGX are effectively made unavailable to other Licensees.
- Construct their Licensed Software Applications to enable complete removal on end user request, including removal of any sealed data.
Responsible Reporting to Intel
Where you, the Licensee, suspect that Intel software may have a bug or security flaw, you must privately inform Intel of the issue in a timely fashion and work with Intel to address the potential issue. Intel will assess the issue and, if necessary, devise a remedy, taking into account the severity of the issue. You must refrain from any public disclosure of the issue prior to reaching agreement with Intel on the timetable and content for such disclosure. For further details on reporting security issues to Intel see https://security-center.intel.com.
System Components for Intel SGX
Platform Software Installer for Intel SGX
The Platform Software (PSW) Installer for Intel SGX is a prerequisite for running Production Applications for Intel SGX on Intel SGX capable systems. As the PSW for Intel SGX may not be pre-installed by OEMs or the Operating System provider, all Licensed Applications are required to include it as a component within their product installer. The PSW installer for Intel SGX performs standard version checking to determine if a current or newer version has been previously installed on the client machine.
Services for Intel SGX
Intel will provide an Attestation Service for Intel SGX for parties relying on Intel SGX to verify quotes received from an Intel SGX-capable platform. Developers should leverage the Development Attestation Service endpoint when developing and validating support for Intel SGX in their application. As a developer transitions to become a Licensee, the Licensee should migrate their application servers to use the Production Attestation Service endpoint.
Intel may introduce new versions of the Attestation Service over time, and will support a specified number of older versions. The Licensee is responsible for transitioning their application / solution to a supported version prior to the “end of support” date of an older version.
Trusted Computing Base (TCB) Updates
Intel may issue periodic updates to parts of the platform that are critical to Intel SGX. Some parts of the TCB are included in the Platform SW Installer, and therefore the Licensee is responsible for the delivery of this update.
Expect communication from Intel on the definition and scope of issues related to a TCB update, including a list of affected components with a SLA for updated component delivery.
A TCB Recovery Event is a strong indicator that an exploitable vulnerability existed and has been remediated. Such an update will coincide with Intel being able to issue a new attestation key to updated platforms.
The Licensee should consider the impact of a TCB update to their relying party software which makes use of the Attestation Service for Intel SGX.
Updates and Communication
As Intel produces updated versions of the PSW for Intel SGX, developers are expected to deploy the PSW update via their application’s product update delivery mechanism. The schedule for performing the update depends on the type.
For Security Updates – Intel will issue a standard information advisory on https://security-center.intel.com should we discover a vulnerability with the distributable components of the PSW or SDK for Intel SGX.
For TCB Updates: evaluate the impact to the Application as well as the Application Server and take necessary action.
For Technology Updates – Intel will from time to time update the PSW, SDK, and Services. As Intel releases updates, we will work with Licensees to determine a transition period.
In general, Developers should subscribe to Intel SGX communications and promptly take the recommended action(s) (e.g., patch/update information, TCB recovery information, SDK / Platform Software updates, Service version updates), notify Intel of issues and follow the documented customer escalation process.
Enclave Signing Key Management
A Licensee’s enclave private signing key, if lost, could be used by malware to sign enclaves, including one that may be used to attest to the developer’s attestation server. Thus, loss of the Licensee’s enclave private signing key not only impacts the Licensee’s reputation but could also pose a significant risk of IP theft.
Licensees must inform Intel as soon as reasonably possible after becoming aware of any risk to, theft, or compromise of an enclave private signing key.
Intel recommends that developers and Licensees use a protected environment such as an HSM-managed enclave signing system for production signing (NOTE: This is only needed for production signing, not development (debug) signing. Production signing enclaves should be performed after completing code reviews, security reviews, and functional validation).
Intel also recommends that developers and Licensees use industry best practices for key management to protect the enclave signing private key from theft (by insiders or external agents), compromise (accidental release or discovery due to negligence) or other abuse.
A reference for best practices:
https://www.thawte.com/code-signing/whitepaper/best-practices-for-code-signing-certificates.pdf