Search code examples
sgx

DCAP and EPID attestation

There are two different attestation mechanism which can be used for remote and local attestation in intel SGX . Does any one know what are the differences between DCAP and EPID attestation in Intel SGX?

Solution

  • EPID is a "standard" attestation mode, where, very basically:

    • a client enclave contacts an attestation server
    • at a point during the process, the server will contact Intel's Attestation Server to fetch information about the requesting enclave
    • based on this information, it will decide whether it trusts the requesting enclave or not.

    DCAP is almost the same, but it doesn't involve Intel's Attestation Server. It's, basically, made for contained architecture that cannot allow a frequent communication with Intel.