Enclave NOT TRUSTED - CONFIGURATION_AND_SW_HARDENING_NEEDED

[iammrgenie]

Trying to test remote attestation on an Intel® Core™ i7-8665UE Processor but I keep getting the error in the title. Find below the details.

advisoryURL = https://security-center.intel.com
advisoryIDs = INTEL-SA-00219,INTEL-SA-00289,INTEL-SA-00334

+++ Verifying report version against API version

---- ISV Enclave Trust Status ----------------------------------------------
Enclave NOT TRUSTED - Reason: CONFIGURATION_AND_SW_HARDENING_NEEDED
A Platform Info Blob (PIB) was provided by the IAS

Initially, I had a microcode out of date error for which I updated the bios to fix.

1. How do I resolve this?
2. If not, is there a way to go around this?

Thanks

[XNinety9]

There's been a lot of discussion around this topic, see here and here for aexample.

To sum things up: a CPU/BIOS microcode upgrade might help (see here), but as Intel is ditching SGX for Desktop grade CPUs, it is very likely that some SA affecting your CPU will never be fixed.

Then again, all is not lost. When running a remote attestation, when processing MSG3 your RA server has to decide, based on the SA list, whether it will trust the requesting enclave or not. Having unresolved SAs is not an issue per-se, but your RA server must examine each of them to determine if some of them have an impact on your system's security.

Hope it helps.