Q1 2023 Intel® Software Guard Extensions Trusted Computing Base (TCB) Recovery
Intel will be executing an Intel® Software Guard Extensions Trusted Computing Base (TCB) Recovery starting in February. Once complete, the TCB will reflect security updates and mitigations for in-scope Intel® SGX products from Intel Platform Update (IPU) 2023.1, and Intel® Xeon® D Processors (code-named Idaville).
Mitigations in Scope for Intel® SGX in IPU 2023.1
The presence of mitigations for the following security advisories will be enforced in this TCB recovery:
- 3rd Generation Intel® Xeon® Scalable Processors Advisory (INTEL-SA-00730)
- 2023.1 IPU - Intel® Xeon® Processor Advisory (INTEL-SA-00738)
- 2023.1 IPU – Intel® Processor Advisory (INTEL-SA-00767)
Attestation responses will change as a result of the TCB Recovery. Developers can find previous responses and additional details in the Intel® SGX Attestation Technical Details. Further TCB Recovery Guidance for developers is also available.
Account / Partner Action Required
Partners who wish to gain confidence, via attestation, that the intended software is securely running within an enclave on an updated Intel SGX-enabled platform containing the latest patches should complete the below recommendations, listed by common partner type.
Important Note: For 3rd Generation Intel® Xeon® Processor (code-named Ice Lake), when Intel SGX is enabled, the BIOS and microcode must be aligned to the applicable IPU 2023.1 (or Icelake D (Idaville)) product version, or the system will hang. For details, refer to the Recommendation section of the applicable Security Advisory, INTEL-SA-00738.
Actions Required by Partner Type
Platform Owners (Cloud Service Providers (CSPs), Enterprise IT, Independent Software Vendors (ISVs) Self-managing Bare Metal Platforms, etc.)
- FIT load microcode, which could include obtaining a new BIOS from your platform Original Equipment Manufacturer (OEM) / Original Device Manufacturer (ODM) that contains the microcode provided by Intel to mitigate potential security vulnerabilities in scope.
- For 3rd Generation Intel® Xeon® Scalable platforms, you must re-register your platforms with the Intel® Registration Service for Scalable Platforms.
- Follow all prior configuration guidance for published mitigations as needed (ex where platforms must be configured (via BIOS setup) with Intel® Hyper-Threading Technology (Intel® HT Technology) disabled to receive a particular Attestation response).
Intel® SGX ISVs or Similar
- If leveraging the Intel® Software Guard Extensions Attestation Service Utilizing Intel® Enhanced Privacy ID (Intel® SGX Attestation Service Utilizing Intel® EPID), update your Intel® Software Guard Extensions Platform Software (Intel® SGX PSW) to at least v2.17 (for Linux* OS) or v2.16 (for Windows OS) on all your Intel® SGX Virtual Machines (VMs)/bare metal OS installs.
- If leveraging Intel® Software Guard Extensions Provisioning Certification Service (Intel® SGX PCS), update your Intel® Software Guard Extensions Datacenter Attestation Primitives (Intel® SGX DCAP) software to at least v1.14.
- Update your Intel® Software Guard Extensions Software Development Kit (Intel® SGX SDK) for Linux* OS to at least v2.17, or your Intel® SGX SDK for Windows OS to v2.16. Intel recommends incrementing all your enclaves’ ISVSVNs, and then recompile, re-sign, and re-deploy your enclaves.
- If performing your own attestation service/quote verification, make sure your verification code can manage all replies from the Intel® SGX Attestation Service Utilizing Intel® EPID / Intel® SGX PCS QVL (Quote Verification Library). This includes both new replies (for example, CONFIGURATION_NEEDED) as well as new Security Advisories listed. Note there are no new reply values expected for 2023.1-mitigated items.
Attestation Service / Quote Generation / Verification Owners
- Download new platform Provisioning Certification Key (PCK) certificates for the newly registered platforms, either from your infrastructure provider or, if you own or control your infrastructure, directly from Intel® SGX PCS.
- If running a local provisioning certification caching service, download and cache new attestation verification collateral (for example, TCB Info, QEIdentity, etc.) for the new TCB level.
Key Dates for Intel® SGX Attestation Service Utilizing Intel® EPID Customers
- February 21, 2023 (Development Enforcement): The Development Environment for Intel® SGX Attestation Service utilizing Intel® EPID (IAS-DEV) will enforce the presence of microcode and software updates on platforms in scope.
- Platforms in scope (listed by CPUID): 706A1, 706A8, 706E5, A0670, A0671 (Product Lookup)
- April 4, 2023 (Production Enforcement): The Production Environment for Intel® SGX Attestation Service utilizing Intel® EPID (IAS-LIV) will enforce the presence of microcode and software updates on platforms in scope (see above).
Unless otherwise specified, updates are targeted around 4:00 am Pacific Standard Time.
Key Dates for Intel SGX DCAP Customers
- April 4, 2023: Availability of new Endorsements / Reference Values (such as PCK Certificates and verification collateral) with 30 day expiration for all in-scope Intel® SGX platforms supporting Elliptic Curve Digital Signature Algorithm (ECDSA) attestation.
- Platforms in scope (listed by CPUID): 606A6, 606C1 (Product Lookup)
Please note that due to the nature of the update required for IPU 2023.1, and having considered the nature of the potential security vulnerabilities, Intel is deferring publication of the updated Endorsements / Reference Values to provide infrastructure providers additional time to complete their update cycles.
Unless otherwise specified, updates are targeted around 4:00 am Pacific Standard Time.