Article ID: 000057968 Content Type: Product Information & Documentation Last Reviewed: 08/05/2021

Unable to find Alternatives to Monotonic Counter Application Programming Interfaces (APIs) in Intel® Software Guard Extensions (Intel® SGX) for Linux* to Prevent Sealing Rollback Attacks

Environment

Intel® Software Guard Extensions (Intel® SGX) SDK v2.9 and above

BUILT IN - ARTICLE INTRO SECOND COMPONENT
Summary

Accessing external sources of trusted time from Intel® Software Guard Extensions enclaves that help prevent sealing rollback, or data replay, attacks

Description
  • Attempting to prevent sealing replay attacks using the Intel® Software Guard Extensions (Intel® SGX) SDK for Linux*
  • The Intel SGX Software Development Kit (SDK) for Linux is missing the monotonic counter APIs: get_trusted_time() and get_trusted_counter().
Resolution

In an Intel® Software Guard Extensions (Intel® SGX) enclave running on a Linux* server platform, there currently is no way to get a trusted time using Intel SGX APIs. Some Cloud Service Providers who require trusted time are using a remote or centralized trusted time source. For counters, some use the Trusted Platform Module (TPM).

  1. Refer to Trusted Platform Module Library Part 3: Commands to find information on the TPM2_GetTime and TPM2_ReadClock primitives.
  2. Call the external sources of trusted time from functions in the untrusted app.
  3. Implement OCALLs in the SGX enclave that call those functions in the untrusted app.
Additional information

Support for Intel® Software Guard Extensions (Intel® SGX) Platform Services was removed from all Linux*-based platforms, including client platforms, beginning with Intel SGX SDK for Linux 2.9.

The Intel SGX API for monotonic counters is still part of the Intel® Software Guard Extensions (Intel® SGX) SDK for Windows* and is supported on Windows® 10 platforms through the Intel SGX Platform Software for Windows. The Intel SGX Platform Software for Windows is usually installed through Windows Update from the platform OEM.

Related Products

This article applies to 1 products

Disclaimer

1

All postings and use of the content on this site are subject to Intel.com Terms of Use.