after gramine-sgx bring program up and we backup pem file to secure location, can we delete gramine/enclave-key.pem file ??

[likegogogo]

rt
thanks

[dimakuv]

I'm not sure I understand the question exactly.

The enclave-key.pem you're referring to is the enclave signing key. This key is used purely to sign the enclave (more precisely, to sign the complete Gramine SGX application). The tool for this signing is called gramine-sgx-sign; in our examples, we invoke this tool from within the Makefile used to build the Gramine SGX application.

After the signing step with gramine-sgx-sign, the signing key is not used for anything. This key is not required to run the Gramine SGX application (via gramine-sgx).

So technically, you need to have access to the signing key only during the gramine-sgx-sign step. At all other times, this key should be "hidden".