Follows up on 590856d (removing the Linux LE).
Removes all of whitelist management and LE facilities from the AESM and SDK.
Leaves only skeleton API stubs behind (for partial ABI compatibility).
!BREAKING CHANGES!
- Launch-related stub(`libsgx_launch.so`) and simulation (`libsgx_launch_sim.so`) libraries
removed from the SGX SDK.
- Removed AESM support for the deprecated Linux SGX out-of-tree (OOT) driver
(will no longer attempt an enclave load if OOT driver is detected)
- AESM APIs for launch control and whitelist management will now
return SGX_ERROR_FEATURE_NOT_SUPPORTED:
Affected APIs:
* get_launch_token(...)
* sgx_get_whitelist_size(...)
* sgx_get_whitelist(...)
* sgx_register_wl_cert_chain(...)
- Deprecated `sgx_uae_launch.h` SDK header
- Marked init token inputs `reserved` in the relevant loader APIs (no longer in use)
---------
Co-authored-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Intel® Software Guard Extensions (Intel® SGX) for Linux OS includes the following changes in version 2.26:
- Upgraded to OpenSSL 3.1.6.
- Removed support for the MbedTLS Trusted Library.
- Added support for Red Hat Enterprise Linux Server 9.4 (for x86_64) and SUSE Linux Enterprise Server 15.6 64-bits.
- Added support for the FIPS 140-3 Certifiable OpenSSL Provider as an experimental feature.
- Bug fixes.
Signed-off-by: Gotowalski, Bartosz <bartosz.gotowalski@intel.com>
Upgraded to OpenSSL 3.0.13.
Upgraded to Intel(R) Integrated Performance Primitives (IPP) Cryptography library
version 2021.11.
Upgraded to Protobuf 3.23.2.
Upgraded MbedTLS to 3.5.2.
Upgraded Intel DCAP Ring3 Abstraction Layer (R3AAL) library to support ConfigFS-TSM
as communication channel between host and guest for TDX remote attestation.
Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.13.
Upgraded new TDX attestation result “TD_RELAUNCH_ADVISED” in Intel DCAP Quote
Verification Library (QVL) and Appraisal Engine.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded to OpenSSL 3.0.10.
Added interoperable RA-TLS support which follows CCC design.
Enhanced Protect File System performance and added additional dependency
`libsgx_pthread.a`.
Added the Constant Time instruction Decoder (CTD) into the default AEX-Notify
mitigation handler in order to prevent the introduction of any additional
subtle sidechannel leakages within the default handler.
Added Mistletoe 3 mitigations to the IPP Cryptography Library to the AES-ECB,
AESGCM, and AES-CMAC algorithms. These have been incorporated transparently
into the `sgx_tcrypto` library.
Resigned all Intel® SGX Architecture Enclaves.
Upgraded Intel SGX Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.10.
Added Attestation Library support for Intel(R) TDX Migration TD.
Added Rust wrapper for low-level Quote Generation APIs.
Enabled `SE_TRACE` log in release binary.
Updated Rust QVL wrapper to use native Rust structure for quote verification
collateral.
Added a limitation in the DCAP QVL to only allow the user to set the QvE load
policy once.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Supported loading enclave at address 0.
Upgraded Intel(R) Quote Verification Enclave to integrate SgxSSL/OpenSSL version 1.1.1k.
Updated the DCAP driver V1.33 with stability fixes, released as V1.33.2. This is to support
legacy solutions not ready to transition to the latest DCAP driver V1.41 or kernel 5.11+.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Provided a reproducible SDK.
Supported new OS: RHEL 8.1, CentOS 8.1 and Fedora 31.
Supported user to specify platform id in PCK Cert ID Retrieval Tool’s command line option.
Added ability to execute Platform Cert ID Retrieval Tool on multi-package platforms without
loading enclaves. PCCS now supports this functionality. The platform still needs to support
SGX.
Updated Platform Cert ID Retrieval Tool and Multi-package registration tool to align with BIOS
platform manifest changes.
Added .deb and .rpm installers for Platform Cert ID Retrieval Tool and Multi-package
Registration Agent.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
On error, realpath does not populate the output array. Zero out the
arrays before passing them to realpath.
Signed-off-by: Seth Moore <sethmo@google.com>
Added new APIs in sgx_uae_service.h and sgx_ukey_exchange.h to support ECDSA quote based remote attestation.
The set of legacy APIs supports EPID only and the set of new APIs supports ECDSA quotes.
Enhanced Edger8r with structure deep-copy feature.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added support for the Key Separation and Sharing (KSS) feature.
Provided a set of new encryption and decryption functions such as sgx_hmac256_*.
Provided a new untrusted API: sgx_get_target_info.
Provided a new untrusted API: sgx_create_enclave_from_buffer_ex.
Updated the cryptography library and Architecture Enclaves to use Intel(R) Integrated
Performance Primitives Cryptography 2019 Update 1.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Support for Ubuntu 18.04 LTS 64-bit Desktop and Server version
Provided a new set of SGX common loader APIs in sgx_enclave_common.h
Provided the sample code for Switchless Call
Provided a new API in tcrypto: sgx_ecc256_calculate_pub_from_priv
sgx_create_enclave API will ignore the parameter of launch token and will not update it after function successfully returns
Change Intel SGX PSW installer for Ubuntu by
- Using .deb installer.
- Using name libsgx-enclave-common_{version string}-1_amd64.deb.
- Installing Intel SGX Enclave Common loader library.
Bug fixes
Signed-off-by: Li, Xun <xun.li@intel.com>
Set misc_attr in the top level sgx_create_enclave if _create_enclave
fails. This provides the user with the platform's capabilities when
sgx_create_enclave fails for any reason other than a parameter error.
Previously the misc_attr was only set upon failure if build_image
failed, which was not helpful when sgx_create_enclave failed due to
an attribute error, e.g. misc_select, as the flow aborted before it
reached build_image.
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Mateusz Bronk