SGX Report breakdown
SGX report is used to verify that the signing authority is rooted to a trusted authority such as the enclave platform manufacturer. Practically, it means that you can verify that the code is running in a Trusted Execution Environment. It also includes a number of attributes you, as a consumer of the report, need to verify yourself.
Data
The report data that has been included in the report. This can be any data up to 64 bytes that the enclave signs and attests to.
How do I verify it?
Check the developer's documentation for details about the report data in each specific case.
SecurityVersion
Enclaves that represent different versions of a module can have different security version numbers.
The SGX design disallows the migration of secrets from an enclave with a higher SecurityVersion
to an enclave with a lower SecurityVersion
. This restriction is intended to assist with the distribution of security patches, as follows.
If a security vulnerability is discovered in an enclave, the developer can release a fixed version with a higher SecurityVersion
.
As users upgrade, SGX will facilitate the migration of secrets from the vulnerable version of the enclave to the
fixed version.
How do I verify it?
Check the developer's documentation and release pages about important security updates.
Debug
If true, the report is for a debug enclave. From a practical standpoint, this means that secrets will never be migrated between enclaves that support debugging and production enclaves.
How do I verify it?
Check the developer's documentation if they're running their enclaves in debug mode. Generally, you want to check that debug mode is disabled for production systems.
UniqueID
UniqueID uniquely identifies enclave. It changes if the program changes.
How do I verify it?
Check the developer's documentation and release pages about the version of the software they're running. You can also verify that there were no changes to the source code compared to the published source code thanks to Reproducible builds.
SignerID
SignerID uniquely identifies enclave's signer. A developer generates a pair of RSA keys, which they use to sign enclaves.
How do I verify it?
Check the developer's documentation to find the signer ID for the software they're running.
ProductID
ProductID uniquely identifies a Product - changed by the developer to indicate different software modules, which are a part of the same enclave. All the enclaves whose signatures have the same ProductID
and are issued by the same RSA key (and therefore have the same UniqueID
) are assumed to represent different versions of the same software module.
How do I verify it?
Check the developer's documentation to find the product ID for the software they're running.
TCBStatus
TODO