Removed:
- Support for EPID based Attestation. Including Remote Attestation. (sgx_uae_epid.h, sgx_key_exchange.h)
- Support for Quote version 1 and 2
---------
Signed-off-by: Lukasz Juzwiuk <lukasz.a.juzwiuk@intel.com>
Updates the `dcap_source` submodule to a version with new project structure
---------
Signed-off-by: Sebastian Przystawski <sebastian.przystawski@intel.com>
Updated include paths to use the new directory structure
Updated installer BOM files to reflect the new path
---------
Signed-off-by: Sebastian Przystawski <sebastian.przystawski@intel.com>
- Updates the DCAP submodule to incorporate a PCCS fix that addresses how PCK certificates are handled when being inserted into TCB buckets
- Changes QVL repository name in submodules list to the new one
- Copyright headers dates corrected
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Introduces a new patch file to bump protobuf Go dependency to v1.33.0
Updates Makefile targets to apply the new patch during build preparation
Integrates the patch application into both external/protobuf and root Makefile workflows
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
- Updates the version number for DCAP components.
- Updates the license file for PCKCertSelection to Intel Simplified.
- Updates the supported operating systems list across multiple README files.
- Fixes the Quote Verification Sample to support both Windows and Linux.
- Bumps PCCS dependency validator.js from 13.15.20 to 13.15.23.
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Updated the dcap_source submodule commit hash from `ed7a99c3355922e3de3950d5c298af734a5474f8` to `1d096c725b1e6e7614d91f8b1b4393b333c719e2`
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Updates the DCAP (Data Center Attestation Primitives) subproject to a new version that includes QVE (Quote Verification Enclave) updates
---------
Signed-off-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
Updates the DCAP (Data Center Attestation Primitives) submodule to a newer commit, incorporating the latest PCCS (Provisioning Certificate Caching Service) and upstream changes
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Removed the `#undef __AVX__` line from the SGX-specific preprocessor block in the Abseil patch.
Change needs to be reintroduced in a different manner not impacting upgrades from 2.26 to 2.27 version
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Updated the dcap_source submodule commit reference from `838f26f690ab550ece234faa19c5b1a9b9e84284` to `8b78014ba7e5a0a2beeafb24a13bc903dbb3d640`
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Updates the DCAP submodule commit hash from `3ccb75837871e6685138ec1d3224e55de7bb0bd3` to `838f26f690ab550ece234faa19c5b1a9b9e84284`
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
Switches OpenSSL from version 3.1.6 to 3.0.17 (and from 3.0.13 to 3.0.17 in sample code)
Updates SGXSSL from 3.1.6_Rev1 to 3.0_Rev5 (that runs on OpenSSL 3.0.17)
Updates the dcap_source subproject commit reference to the one relying on OpenSSL 3.0.17 and SGXSSL 3.0_Rev5
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Follow-up of upstream DCAP repo change which added `{deb|rpm}_pccs_admin_tool_pkg` make targets.
Adds corresponding build targets to the top-level `Makefile` (the package is now included in the "local repo" archive).
---------
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Follow-up of upstream DCAP repo change which added `intel-tee-pcs-client-tool-*{.deb|.rpm}` packages.
Adds corresponding build targets to the top-level `Makefile` (the package is now included in the "local repo" archive).
---------
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Updates the DCAP submodule to a new commit after separating PCCS Admin Tool (into PCCS Admin Tool and PCS Client Tool), moving PCCS related files to a new repository and linking that repository to DCAP repo via submodule.
---------
Signed-off-by: Pawel Krzysztof Blajer <pawel.krzysztof.blajer@intel.com>
* Bumped C++ standard from 14 to 17 in the CMake configuration
* Updated DCAP source submodule to a newer commit with -lpthread flag for GTEST
---------
Signed-off-by: GracjanX Klodkowski <gracjanx.klodkowski@intel.com>
In recent changes to DCAP submodule PCCS paths have been changed. This PR updates to newest submodule and adjusts paths.
---------
Signed-off-by: Pawel Krzysztof Blajer <pawel.krzysztof.blajer@intel.com>
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Adds a cross-platform filename extraction macro that works with both Unix and Windows path separators
Updates production logging to use the cleaner filename format instead of full file paths
Updates the dcap_source submodule to a newer commit
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
Several updates in DCAP submodule:
* Removing strip operation as debug info is later stripped while creating deb/rpm prod, dev and debug packages
* Bump brace-expansion from 1.1.11 to 1.1.12 in /QuoteGeneration/pccs
* Bump on-headers and morgan in /QuoteGeneration/pccs
* Bump tar-fs from 2.1.2 to 2.1.3 in /QuoteGeneration/pccs
* Update dcap components nuget License.txt to match Intel Simplified Software License (Version October 2022)
* Fix to ensure safe path buffer operations.
* Platform Manifest buffer limited to 256KB for PCKRetrievalTool
* Fixed paths to WDK
* Added fixes to building sgxssl.cmd
* Admin tools inf packaging process updated. Switched to latest prebuilt AE.
* Added path to libsgx_usgxssl
Signed-off-by: Gotowalski, Bartosz <bartosz.gotowalski@intel.com>
Intel® Software Guard Extensions (Intel® SGX) for Linux OS includes the following changes in version 2.26:
- Upgraded to OpenSSL 3.1.6.
- Removed support for the MbedTLS Trusted Library.
- Added support for Red Hat Enterprise Linux Server 9.4 (for x86_64) and SUSE Linux Enterprise Server 15.6 64-bits.
- Added support for the FIPS 140-3 Certifiable OpenSSL Provider as an experimental feature.
- Bug fixes.
Signed-off-by: Gotowalski, Bartosz <bartosz.gotowalski@intel.com>
Upgraded to OpenSSL 3.0.14.
Upgraded Intel(R) Integrated Performance Primitives (IPP) Cryptography library to version
2021.12.1.
Supported FIPS 140-3 Certifiable IPP Crypto based Trusted Library.
Upgraded Intel SGX Architecture Enclaves based on new IPP crypto library.
Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.14.
Removed Intel DCAP PCCS from repository.
Added Ubuntu* 24.04 LTS 64-bit Server support.
Fixed bug.
Note that PCCS is not available from this release. Please follow DCAP installation guide to use
`PCCSAdminTool` to retrieve the attestation collaterals or use old version PCCS.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded to OpenSSL 3.0.13.
Upgraded to Intel(R) Integrated Performance Primitives (IPP) Cryptography library
version 2021.11.
Upgraded to Protobuf 3.23.2.
Upgraded MbedTLS to 3.5.2.
Upgraded Intel DCAP Ring3 Abstraction Layer (R3AAL) library to support ConfigFS-TSM
as communication channel between host and guest for TDX remote attestation.
Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.13.
Upgraded new TDX attestation result “TD_RELAUNCH_ADVISED” in Intel DCAP Quote
Verification Library (QVL) and Appraisal Engine.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded to OpenSSL 3.0.10.
Added interoperable RA-TLS support which follows CCC design.
Enhanced Protect File System performance and added additional dependency
`libsgx_pthread.a`.
Added the Constant Time instruction Decoder (CTD) into the default AEX-Notify
mitigation handler in order to prevent the introduction of any additional
subtle sidechannel leakages within the default handler.
Added Mistletoe 3 mitigations to the IPP Cryptography Library to the AES-ECB,
AESGCM, and AES-CMAC algorithms. These have been incorporated transparently
into the `sgx_tcrypto` library.
Resigned all Intel® SGX Architecture Enclaves.
Upgraded Intel SGX Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.10.
Added Attestation Library support for Intel(R) TDX Migration TD.
Added Rust wrapper for low-level Quote Generation APIs.
Enabled `SE_TRACE` log in release binary.
Updated Rust QVL wrapper to use native Rust structure for quote verification
collateral.
Added a limitation in the DCAP QVL to only allow the user to set the QvE load
policy once.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Supported the AEX (Asynchronous Enclave Exit) Notify feature.
Supported Mbed-TLS Cryptography library (excluding SSL/TLS portion) in Enclave.
Applied patches to OpenSSL 1.1.1t, fixed CVE-2023-1255, CVE-2023-0465 and
CVE-2023-0466.
Upgraded to Intel(R) Integrated Performance Primitives (IPP) Cryptography
library version 2021.7.
Upgraded Intel SGX Quote Verification Enclave to integrate updated SgxSSL.
Enhanced the attestation local cache functionality by giving users the option
to provide their own cache file.
Enabled QPL/QCNL log in DCAP samples.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Supported the Key Separation and Sharing (KSS) feature in Simulation mode.
Upgraded to OpenSSL 1.1.1t.
Upgraded Intel(R) SGX Quote Verification Enclave to integrate SgxSSL/OpenSSL
version 1.1.1t.
Added new API in quote verification library to extract FMSPC
(Family-Model-SteppingPlatform-CustomSKU) value from ECDSA quote.
Added Rust support for SGX ECDSA quote generation.
Added Linux kernel 5.19 support in TDX R3AAL (Ring 3 Attestation Abstraction Layer).
Removed Protobuf in TDX QGS (Quote Generation Service) and R3AAL (Ring 3
Attestation Abstraction Layer).
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
The proposed change makes it easier to perform unattended installations in e.g. docker containers or VMs.
The `git am` command applies patches and attempts to commit the changes.
Yet, in order to commit git requires `user.name` and `user.email` to be configured, which are both usually not set in containers or VMs.
Based on my testing it is enough to simply apply the patch to avoid git asking for the user's name and email.
Signed-off-by: Muhammad El-Hindi muhammad.el-hindi@cs.tu-darmstadt.com
ljuzwiuk