SGX SDK–related attestation headers and the TVL sources originating from DCAP
tag: 'DCAP_1.25' are now relocated:
FROM: the intermediate staging area: './external/from_dcap'
(created by the '[from DCAP][move 1/2]...') commit 5b0b8e9)
INTO: their target SGX SDK repository layout.
This is a follow-on commit that places relocated files in its final locations
and updates the build system accordingly.
Additional changes:
--------------------
- `libsgx-headers` DEB/RPM package now also contains the following 2 headers:
1) sgx_qve_header.h
2) sgx_dcap_qal.h
Leveling w/ SDK - both files were part of the SDK already.
- SDK installer package now also contains the `sgx_dcap_constant_val.h` header
(from TVL), including common QvE and QAE identity verification constants.
---------
Signed-off-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
Added explicit `libcxxrt` dependency to the `cpprt` target to ensure artifacts are available before building
Removed `libcxxrt` from `$(LIBTCXX)` dependencies since it's now transitively satisfied through `cpprt`
Simplified the `$(LIBCXXRT_STAMP)` rule by removing unnecessary `flock` synchronization logic
---------
Signed-off-by: Lukasz Kalica <lukasz.kalica@intel.com>
libcxxrt library wasn't updated for a long time. CentOS 10 introduced a new version of gcc and g++ compilers which are more strict than compilers in CentOS 9 and earlier. Because of that, a build of cpprt module (which contains source code of libcxxrt) was failing. Now libcxxrt module was extracted from cpprt module to sgx/external/ directory and its sources (in the latest version) are cloned directly from the external Github repository. It required a few adjustments to build cpprt module successfully on Linux distros.
---------
Signed-off-by: Lukasz Kalica <lukasz.kalica@intel.com>
Removed:
- Support for EPID based Attestation. Including Remote Attestation. (sgx_uae_epid.h, sgx_key_exchange.h)
- Support for Quote version 1 and 2
---------
Signed-off-by: Lukasz Juzwiuk <lukasz.a.juzwiuk@intel.com>
Renamed the temporary extraction directory from `.libcbor` to `.tdx_cbor` in the TDX-specific build target to avoid conflicts
Added explicit `cbor_untrusted` phony target and declared it as a dependency for `ttls` and `utls` targets to ensure proper build ordering
Added cleanup rule for the cbor external directory
---------
Signed-off-by: Lukasz A Juzwiuk <lukasz.a.juzwiuk@intel.com>
Intel® Software Guard Extensions (Intel® SGX) for Linux OS includes the following changes in version 2.26:
- Upgraded to OpenSSL 3.1.6.
- Removed support for the MbedTLS Trusted Library.
- Added support for Red Hat Enterprise Linux Server 9.4 (for x86_64) and SUSE Linux Enterprise Server 15.6 64-bits.
- Added support for the FIPS 140-3 Certifiable OpenSSL Provider as an experimental feature.
- Bug fixes.
Signed-off-by: Gotowalski, Bartosz <bartosz.gotowalski@intel.com>
Supported the AEX (Asynchronous Enclave Exit) Notify feature.
Supported Mbed-TLS Cryptography library (excluding SSL/TLS portion) in Enclave.
Applied patches to OpenSSL 1.1.1t, fixed CVE-2023-1255, CVE-2023-0465 and
CVE-2023-0466.
Upgraded to Intel(R) Integrated Performance Primitives (IPP) Cryptography
library version 2021.7.
Upgraded Intel SGX Quote Verification Enclave to integrate updated SgxSSL.
Enhanced the attestation local cache functionality by giving users the option
to provide their own cache file.
Enabled QPL/QCNL log in DCAP samples.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded to OpenSSL 1.1.1m.
Provided RA-TLS (Remote Attestation based Transport Layer Security) APIs and
Samples.
Supported PKRU (Protection Key rights Register) in Enclave.
Added APIs of SHA384 and VerifyReport2 to support TDX.
Enhanced QPL (Quote Provider Library) to support caching Intel PCK
(Provisioning Certificate Key) certificate chain in local memory, or
retrieving Intel PCK cert chain from local HTTP/S address.
Upgraded Intel ECDSA Quote Verification Enclave to integrate SgxSSL/OpenSSL
version 1.1.1m.
Introduced Intel ID enclave for QE identity generation.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added more logs in PSW components for identifying issues.
Upgraded OpenSSL and SgxSSL to latest version 1.1.1i in DCAP components.
Added data base migration support in PCCS.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added support for Reproducible Enclave Build using Docker file.
Added support for Intel AVX-512 instructions and Intel SHA Extensions New Instructions (SHA-NI) in trusted libraries.
Support both EPID and ECDSA based quote for quoting related interfaces in sgx_uae_service library.
Updated key exchange library to support both EPID and ECDSA based remote attestation.
Support new interface to check platform information blob from remote attestation response message.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added new APIs in sgx_uae_service.h and sgx_ukey_exchange.h to support ECDSA quote based remote attestation.
The set of legacy APIs supports EPID only and the set of new APIs supports ECDSA quotes.
Enhanced Edger8r with structure deep-copy feature.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added support for the Key Separation and Sharing (KSS) feature.
Provided a set of new encryption and decryption functions such as sgx_hmac256_*.
Provided a new untrusted API: sgx_get_target_info.
Provided a new untrusted API: sgx_create_enclave_from_buffer_ex.
Updated the cryptography library and Architecture Enclaves to use Intel(R) Integrated
Performance Primitives Cryptography 2019 Update 1.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
* Adds libsgx_capable, which is currently only available in the Windows
version of the Intel SGX SDK. The Linux implementation of this library
adds the following functions:
sgx_status_t sgx_is_capable (int *sgx_capable);
sgx_status_t sgx_cap_get_status (sgx_device_status_t *sgx_device_status);
sgx_status_t sgx_cap_enable_device (sgx_device_status_t *sgx_device_status);
And adds the following error code (also from the Windows version of the
Intel SGX SDK):
SGX_ERROR_NO_PRIVILEGE
Generates both a static and dynamic build of libsgx_capable. This is
incorporated into the SDK package, not the PSW package, since software
installers need to check for Intel SGX capability on systems where the PSW
may not already be installed. This means that installers will either have
to statically link, or distribute the .so with their installation package.
----------------------
Developer Certificate of Origin
Version 1.1
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
660 York Street, Suite 102,
San Francisco, CA 94110 USA
Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.
Developer's Certificate of Origin 1.1
By making a contribution to this project, I certify that:
(a) The contribution was created in whole or in part by me and I
have the right to submit it under the open source license
indicated in the file; or
(b) The contribution is based upon previous work that, to the best
of my knowledge, is covered under an appropriate open source
license and I have the right under that license to submit that
work with modifications, whether created in whole or in part
by me, under the same open source license (unless I am
permitted to submit under a different license), as indicated
in the file; or
(c) The contribution was provided directly to me by some other
person who certified (a), (b) or (c) and I have not modified
it.
(d) I understand and agree that this project and the contribution
are public and that a record of the contribution (including all
personal information I submit with it, including my sign-off) is
maintained indefinitely and may be redistributed consistent with
this project or the open source license(s) involved.
Signed-off-by: John P Mechalas <john.p.mechalas@intel.com>
Krzysztof Wiśniewski