Developer Guide

  • 10/27/2020
  • Public Content

TCB Recovery Flow

The Intel® Converged Security and Management Engine (Intel® CSME) firmware is the root of trust for the Trust Computing Base (TCB) of Intel® architecture-based systems. When the Intel® firmware in a system is updated with new Intel CSME firmware with incremented Secure Version Number (SVN), the Intel® Enhanced Privacy ID (Intel® EPID) group is changed and a re-key process is required to recover TCB trust.
The re-key process is performed automatically by the Capability Licensing Service (iCLS) software service that is running on the client machine (This software is delivered with the Intel® Management Engine (Intel® ME) / Intel® Trusted Execution Engine (Intel® TXE) software package.) When a re-key process is needed, the end-user system auto-connects to Intel back-end servers, where the local iCLS service communicates to the back end to perform TCB recovery, creating new Intel EPID key and completing the re-key process. Once TCB Recovery is successfully completed, the platform will contain a new Intel EPID key; re-provisioning is not needed. 
The iCLS local service requires an internet connection to connect to the iCLS server for performing the re-key process. This connection uses standard TLS over port 443. If the end user system is inside an intranet (e.g., IT organization), you may need to provide a proxy to allow iCLS to properly connect to the Intel iCLS server back end over the internet. This can be achieved by editing the “%ProgramData%\Intel\iCLS Client\conf\iclsProxy.conf” file, or by setting up a proxy in Windows*. (Starting with iCLS version and above, all supported proxy detection settings (autoproxy scripts configuration and autoproxy detection) are enabled. In previous iCLS versions, only manual proxy setting is supported.)

Product and Performance Information


Intel's compilers may or may not optimize to the same degree for non-Intel microprocessors for optimizations that are not unique to Intel microprocessors. These optimizations include SSE2, SSE3, and SSSE3 instruction sets and other optimizations. Intel does not guarantee the availability, functionality, or effectiveness of any optimization on microprocessors not manufactured by Intel. Microprocessor-dependent optimizations in this product are intended for use with Intel microprocessors. Certain optimizations not specific to Intel microarchitecture are reserved for Intel microprocessors. Please refer to the applicable product User and Reference Guides for more information regarding the specific instruction sets covered by this notice.

Notice revision #20110804