Notes - MCS
Secure Execution Environments
Notes - MCS
Secure Execution Environments
  • Secure Execution Environments
  • Introduction
    • Trusted Computing Base (TCB)
    • TEE (Trusted Execution Environment)
    • Can you trust the operating system?
  • Security in Operating Systems
    • Operating system
    • Virtual machines and hypervisors
    • Computational model
    • Access control
    • Protection with capabilities
    • Unix file protection ACLs
    • Windows NTFS file protection
    • Unix file protection ACLs
    • Privilege elevation
    • Privilege reduction
    • Linux login
  • Virtualization on Intel Processors
    • Modes of Operation
    • Virtual memory
    • How to put assembly instructions inside C code
    • A more elaborate example
    • Useful assembly instructions
  • Intel Software Guard Extensions
    • What is SGX (Software Guard eXtensions)?
    • SGX Enclave Memory
    • Guidelines for designing applications using SGX
    • Performance Overhead
    • SDK compilation modes
    • Writing Enclave Functions
  • ARM TrustZone
    • SoC and IP
    • ARM TrustZone
    • Worlds
    • Architecture
    • TrustZone bootstrap
  • Linux Kernel Namespaces
    • Namespaces
    • Advantages
    • Process Namespace
    • Network namespace
    • Mount namespace
    • UTS namespace
    • User namespace
  • LXC Linux Containers
    • Container
    • LXC containers
  • AppArmor
    • Purpose
    • Enforcement
    • Benefits
    • Attack prevention
    • Enforcement policies
    • Enforcement modes
    • Logging and auditing
    • Profiles
  • TPM (Trusted Platform Module)
    • Trusted Platform Module (TPM)
    • History
    • Cryptographic Concepts
    • Use cases
    • TPM Software Stack (TSS)
    • TPM concepts
    • Entities
    • Key management
    • Restrict signatures
    • Sessions
    • Authorization roles
  • Bootstrap security
    • AEGIS
    • Trusted computing
    • Root of Trust Measurements
    • Trusted Computing Platform Alliance (TCPA)
    • TPM-based attestation
    • Trusted Platform identity credentials
    • UEFI (Unified Extensible Firmware Interface)
    • NSA Boot Security
    • UEFI secure boot & TPM measurements
    • Intel Trusted Execution Technology (TXT)
    • Smartcards
      • Java Cards
      • OpenCard Framework (OCF)
      • Cryptographic services
Powered by GitBook
On this page
  • SGX SDK Tools
  • Edger8r (sgx_edger8r)
  • Enclave signing tool (sgx_sign)
  • Enclave Memory Measurement Tool (sgx_emmt)
  1. Intel Software Guard Extensions

SDK compilation modes

SGX applications can be compiled in several modes:

  • hardware debug mode (signed with Intel's key, code not optimized).

SGX_MODE=HW SGX_DEBUG=1 SGC_PRERELEASE=0

  • hardware prerelease mode (signed with your key, code is optimized).

SGX_MODE=HW SGX_DEBUG=1 SGC_PRERELEASE=0

  • hardware release mode (signed with your key, code is optimized, cannot be debugged).

SGX_MODE=HW SGX_DEBUG=0 SGC_PRERELEASE=0

  • simulation mode (in debug mode).

SGX_MODE=SIM SGX_DEBUG=1

SGX SDK Tools

Edger8r (sgx_edger8r)

Generates "edge" routines (interface between the untrusted application and the enclave) described in an Enclave Description Language (EDL) file.

Using it on file XYZ.edl produces files XYZ_[tu]t.[hc] where t=trusted, u=untrusted, h=prototypes, and c=functions.

Enclave signing tool (sgx_sign)

Supports key management.

Enclave Memory Measurement Tool (sgx_emmt)

Use it to measure how much memory the enclave uses (needed by the Enclave Configuration File).

Last updated 1 year ago