Search code examples
linuxintelsgx

SGX Sign enclave cannot attestate the built enclave: Key file format is not correct

I managed to generate my Enclave (https://github.com/pc-magas/myFirstEnclave) but as far as I know I need to generate an rsa key in order to sign it. So I run:

openssl genrsa -out $(KEY_FILE) 2048

And then I run the following command to sign it:

sgx_sign -key (^key_generated)above^ -enclave enclave.o -out enclave.so -config Enclave.config.xml

But I get the following error:

Key file format is not correct.

Edit 2:

I tried to generate the key via ssh_keygen but still the same error.

What kind of format is needed in order to sign an enclave?

Edit 3:

I also tried to generate the key with:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ~/.sgx/MyEnclave.pem

Still same result

Solution

  • Intel® Software Guard Extensions Developer Reference specifies that SGX enclave signature key file should follow the PEM format which contains an unencrypted RSA 3072-bit key, the public exponent must be 3.

    See page 20 (on version 2.0 November 2017) - OpenSSL Examples, for the following command line to generate the private key:
    openssl genrsa -out private_key.pem -3 3072