Change type of certification data used in the quote (sgx_ql_cert_key_type_t)

[pbeza]

Is there a way to change type of certification data used in the quote?

I'm referring to this:

(page 62 from Data Center Attestation Primitives: ECDSA Quote Library API docs)

The reason I ask is that I would ideally like to have the same quote type for SGXv1 and SGXv2 so that I can verify it with the same code regardless of the CPU version. I'm using this code that seems to support SGXv2 quotes only (with full PCK cert chain).

Currently my app is getting:

• type 3 (PPID_RSA3072_ENCRYPTED, i.e. PCK identifier: PPID encrypted using RSA-3072-OAEP, CPUSVN and PCESVN) for SGXv1
• type 5 (PCK_CERT_CHAIN, i.e. Concatenated PCK Cert Chain) for SGXv2

Sorry, I don't have a full understanding of SGX quote wrapper structures and how Gramine uses them, so I'm not sure if that makes sense.

cc @smtmfft @johntaiko

[kailun-qin]

I don't think Gramine has control over this certification key type.

type 3 (PPID_RSA3072_ENCRYPTED, i.e. PCK identifier: PPID encrypted using RSA-3072-OAEP, CPUSVN and PCESVN) for SGXv1

From Data Center Attestation Primitives: ECDSA Quote Library API docs, you could find below text in section 3.3.1.2:

If the platform quote provider library cannot be found, the sgx_ql_get_quote_config() symbol is not
found within the platform quote provider library or it returns an error, the platform quote library uses
the raw-TCB of the platform to certify the key and use the certification type PPID_RSA3072_ENCRYPTED
as the Quote’s Certification Data Type to identify platform.

It looks like the Platform Quote Provider Library (libdcap_quoteprov.so) is not found on your SGXv1 machine, so the Quote Library falls back to uses the raw-TCB (thus type 3 - PPID_RSA3072_ENCRYPTED) instead of the PCK cert chain (thus type5 - PCK_CERT_CHAIN). So would you pls kindly double check whether the Platform Quote Provider Library is correctly installed on your SGXv1 platform (via e.g., sudo apt list --installed | grep libsgx-dcap-default-qpl)?

[dimakuv]

@kailun-qin is exactly right. I remember hitting the same problem some time ago, and it was a case of missing dependencies.

UPDATE: Found it, see #589.