Signature Policy

Published: 03/29/2016, Last Updated: 03/29/2016

One of the key decisions when registering with the Sandbox Intel Attestation Service (IAS) is the type of attestation:

  • Random Base Mode (unlinkable)
  • Name Based Mode (linkable)

This decision is required during the enrollment process with the Development Services IAS and cannot be changed.

During EPID (Enhanced Privacy ID) provisioning an Intel CPU is given a unique signing key belonging to an EPID group. Each EPID group contains a million CPUs of the same type (e.g. Core i3, i5, or i7). Verifying a signature does not enable you to identify the signer but instead verifies the signer as a member of a valid EPID group. Thus the signature has the attribute of anonymity. A Quote contains an EPID signature.

If you choose the option of unlinkable Quotes, verifying two signatures does not enable you to tell whether they were generated by the same or different signers. 

If you choose the option of linkable Quotes, when verifying multiple signatures you WILL be able to determine if multiple Quotes were generated from the same platform. NOTE: Linkable Quotes do not identify the individual platform a given Quote was generated.  

Note: Linkable Quotes may have privacy implications that require you to obtain user opt-in, which you should consult with a privacy expert.

Additional background on EPID Provisioning and Attestation Services please see this white paper.

Product and Performance Information

1

Intel's compilers may or may not optimize to the same degree for non-Intel microprocessors for optimizations that are not unique to Intel microprocessors. These optimizations include SSE2, SSE3, and SSSE3 instruction sets and other optimizations. Intel does not guarantee the availability, functionality, or effectiveness of any optimization on microprocessors not manufactured by Intel. Microprocessor-dependent optimizations in this product are intended for use with Intel microprocessors. Certain optimizations not specific to Intel microarchitecture are reserved for Intel microprocessors. Please refer to the applicable product User and Reference Guides for more information regarding the specific instruction sets covered by this notice.

Notice revision #20110804