Which key should be used as the RA_TLS_EPID_API_KEY?

[jogi343]

Hi All,

I subscribed to the SGX EPID attestation service from here, and once signed in, I can see the SPID, primary key and secondary key. In the secret provisioning example, I need to provide the RA_TLS_EPID_API_KEY. So which key should be provided as the RA_TLS_EPID_API_KEY? Is it the primary key or secondary?

Regards,

[kailun-qin]

Hi @jogi343!

The RA_TLS_EPID_API_KEY refers to the subscription key (in Section 2.1, SGX Attestation API Spec[1]), which is the "unique API key that Service Provider needs to use to authenticate itself to the service". Both the Primary and Secondary keys are subscription keys [2]. The design of two keys is basically for giving continuity to the service in case a key needs to be regenerated.

So you can use either your Primary key or Secondary key as the RA_TLS_EPID_API_KEY.

[1] https://www.intel.com/content/dam/develop/public/us/en/documents/sgx-attestation-api-spec.pdf
[2] https://www.intel.com/content/www/us/en/support/articles/000090019/software/intel-security-products.html

[jogi343]

Thank you @kailun-qin , secret provisioning is working.