Intel® SGX SDK/PSW 2.30.1

Intel® Software Guard Extensions Platform Software (Intel® SGX PSW)

• Intel® SGX Architecture Enclave Service Manager (AESM)
  • Restored InitQuoteEx IPC compatibility (#1107) — v2.30 marked buf_size as required in the InitQuoteExRequest schema, rejecting requests from pre-v2.30 clients that omit buf_size when b_pub_key_id=false.
    This release restores buf_size to optional and accepts its absence when b_pub_key_id is not set.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS* Stream	SUSE*	Anolis OS*	Azure Linux*
SDK installer	- 22.04 - 24.04 - 26.04	- 10 - 12	- 9.6 - 9.8 - 10.0 - 10.2	- 9 - 10	- 15.7 - 16	- 8.10	- 3.0
Local repo DEB/RPM packages	- 22.04 - 24.04 - 26.04	- 10 - 12	- 9.6 - 9.8 - 10.0 - 10.2	- 9 - 10	- 15.7 - 16	- 8.10	- 3.0

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

Note

📢 ANNOUNCEMENT Upcoming changes planned for the next release

Repository layout change ^{💬 #1108}

1. AESM codebase (/psw dir and supporting build/packaging infrastructure) will be 🚚 moved to a standalone GitHub repository.
   The SGX repository will reference it via a Git submodule.

NOTE: This is a source-code layout change only. Binary deliverables, APIs and packaging are unaffected by this change — if you consume the released binaries or distribution packages, no action is required. If you build from source, clone recursively (--recurse-submodules) to pull the relocated sources.

Retirements

2. SGX SDK will no longer support the non-default OpenSSL/SGXSSL crypto build option (see SDK repo for details).
3. The (alternative) single .spec file RPM packaging targets (psw-dcap and psw-tdx files as well as supporting Makefile.psw_dcap and Makefile.psw_tdx) will be removed as they're unused by Intel official RPM packaging, hence not actively maintained.

Note

2.30.x is the last Intel® SGX SDK/PSW release to publish packages for and validate builds on Debian 10, which reached end of life on June 30, 2024 ^{💬 Debian announcement}.

Intel® SGX SDK/PSW 2.30

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

Note

Intel SGX SDK source code (including samples) as well as the Intel SGX enclave runtime libraries now reside at intel/confidential-computing.sgx.sdk and is referenced as a submodule from intel/confidential-computing.sgx.

See Release Intel® SGX SDK 2.30 · intel/confidential-computing.sgx.sdk for its full release notes.

---

Intel® Software Guard Extensions Platform Software (Intel® SGX PSW)

• Intel® SGX Architecture Enclave Service Manager (AESM)
  • Hardened socket receive path — validates IPC message length before payload read and enforces a finite client socket timeout to prevent indefinite blocking.
  • Strengthened IPC request parsing with strict protobuf dispatch validation and per-request semantic checks for attestation messages.
  • write_callback(): fixed an integer overflow.
• Intel® SGX Runtime System Library
  • Added Intel TDX service TD extension fields (tdx_servtd_ext_t structure in sgx_quote_5.h) to support parsing the SERVTD binding information carried in TDX quotes.
  • Fixed an out-of-bounds write in the ELF parser (parse_dyn) when processing OS-specific address-range dynamic tags.
  • Extracted uRTS, libsgx-enclave-common, and libsgx-headers into a new standalone sgx-enclave-runtime RPM meta-package, splitting them out of the psw-dcap / psw-tdx specs.
• Intel® SGX Architecture Enclaves
  • Updated the SGX Enclave Memory Manager (emm_src) to fix a coexistence bug between EDMM and AEX Notify.
  • PCE ISVSVN bumped to 0x11.
• Other changes
  • Removed build scripts and Docker stages for the long-obsolete PSW .bin binary installer. The PSW has been delivered exclusively via DEB/RPM packages since 2019; the replacement is the {deb|rpm}_psw_aesm_pkg target.
  • Improved RPM packaging tooling: unified debug subpackage suppression across old and new RPM versions; added Debian* trixie to the local repository distributions configuration.
  • Updated supported operating systems:
    • Added Red Hat* Enterprise Linux* Server 9.6, 9.8, 10.0, and 10.2; removed 9.4.
    • Updated SUSE* Linux Enterprise Server support to 15 SP7 and 16; removed 15.6.
    • Added Debian* 13.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS* Stream	SUSE*	Anolis OS*	Azure Linux*
SDK installer	- 22.04 - 24.04 - 26.04	- 10 - 12	- 9.6 - 9.8 - 10.0 - 10.2	- 9 - 10	- 15.7 - 16	- 8.10	- 3.0
Local repo DEB/RPM packages	- 22.04 - 24.04 - 26.04	- 10 - 12	- 9.6 - 9.8 - 10.0 - 10.2	- 9 - 10	- 15.7 - 16	- 8.10	- 3.0

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

Note

2.30.x is the last Intel® SGX SDK/PSW release to publish packages for and validate builds on Debian 10, which reached end of life on June 30, 2024 ^{💬 Debian announcement}.

Intel® SGX SDK/PSW 2.29

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Added Ubuntu 26.04 support.
  • Build dependencies updated to support GCC 15 while remaining backward compatible.
  • Enabled support for CMake 4+.
  • Deprecated and removed the Intel® Software Guard Extensions (Intel® SGX) Eclipse* plug-in from the Intel® Software Guard Extensions SDK (Intel® SGX SDK) source code. The last available version can be downloaded from SGX 2.28 release directory.
• Relocated SGX SDK–related code from the DCAP repository into the SGX SDK repository layout:
  • The Trusted Verification Library (TVL) is part of the Intel SGX SDK distribution.
  • sgx_qve_header.h is distributed with the libsgx-headers package.
• Common structure definitions (tee_policy_bundle_t, tee_policy_auth_result_t) shared between SGX (TVL) and DCAP were extracted to a new header, sgx_dcap_qal_types.h. This header is now part of the Intel SGX repository and is included by DCAP’s sgx_dcap_qal.h.
• Security hardening: Added compiler and linker security flags across buildenv.mk and all SDK component Makefiles.
• Updated Protobuf to 33.4; updated Abseil dependency to 20250512.1.
• Bug fixes.

Note

In the next release, the SGX SDK codebase will be moved to a standalone GitHub repository. The SGX repository will reference the SDK via a Git submodule.

---

Intel® Software Guard Extensions Platform Software (Intel® SGX PSW)

• Added Ubuntu* 26.04 support and enabled CMake 4+ support.
• Security hardening: added compiler and linker security flags across buildenv.mk and all component Makefiles.
• Bug fixes.

Intel® SGX SDK/PSW 2.28

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Removed deprecated functionality based on EPID (Enhanced Privacy ID), including EPID remote attestation.
  • • Note support remains for ECDSA-based attestation and universal quoting APIs (i.e. sgx_get_quote_ex()).
    • The following definitions have been removed from libsgx-headers:
      • sgx_calc_quote_size()
      • sgx_check_update_status()
      • sgx_get_extended_epid_group_id()
      • sgx_get_quote()
        • note: sgx_get_quote_ex() remains supported
      • sgx_get_quote_size()
        • note: sgx_get_quote_size_ex() remains supported
      • sgx_init_quote()
        • note: sgx_init_quote_ex() remains supported
      • sgx_report_attestation_status()
    • The following dev header has been removed: sgx_uae_epid.h
    • Removed libsgx_epid_sim.so, following the removal of EPID-based Provisioning Enclave (PVE), and EPID-based Quoting Enclave (QE) in SGX PSW.
• Removed code supporting the deprecated Launch Enclave, whitelist management and out-of-tree driver.
  • • The recommended launch mechanism continues to be the Flexible Launch Control via the in-kernel SGX driver.
    • The following launch-related UAE APIs are deprecated and will now return SGX_ERROR_FEATURE_NOT_SUPPORTED:
      • get_launch_token()
      • sgx_get_whitelist()
      • sgx_get_whitelist_size()
      • sgx_register_wl_cert_chain()
    • The following dev header has been deprecated: sgx_uae_launch.h
    • The following parameters of sgx_create_enclave() URTS API: *launch_token and *launch_token_updated are now RESERVED and ignored by the implementation. Implementers may choose to continue passing an empty/initialized launch_token_t placeholder or pass a nullptr in their place.
    • Removed libsgx_launch_sim.so following the removal of Launch Enclave (LE) in SGX PSW.
• Enclave creation no longer fails when the Enclave Dynamic Memory Management (EDMM) and AEX-Notify are both enabled.
• Upgraded to OpenSSL 3.0.19.
• Added support for CentOS* Stream 10 and Red Hat* Enterprise Linux* 10.
• Bug fixes.

Note

Intel® Software Guard Extensions (Intel® SGX) Eclipse plugin will be removed in the next release of Intel® SGX SDK.

---

Intel® Software Guard Extensions Platform Software (Intel® SGX PSW)

• Removed deprecated functionality based on EPID (Enhanced Privacy ID), including EPID remote attestation.
  • • The libsgx_epid.so library is removed, including its simulation counterpart in the SGX SDK.
    • Note support remains for ECDSA-based attestation and universal quoting APIs (i.e. sgx_get_quote_ex()).
    • Supporting architectural enclaves: EPID-based Provisioning Enclave (PVE) and EPID-based Quoting Enclave (QE) are no longer distributed.
• Removed code supporting the deprecated Launch Enclave, whitelist management, and out-of-tree driver.
  • • The recommended launch mechanism continues to be the Flexible Launch Control via the in-kernel SGX driver.
    • The libsgx_launch.so library is removed, including its simulation counterpart in the SGX SDK.
    • The libsgx-aesm-launch-plugin as well as the le_launch_service_bundle are removed.
    • Supporting architectural enclave: Launch Enclave (LE), is no longer distributed.
    • Launch whitelist files (white_list_cert*.bin) and signature files (le_prod_css.bin) are removed as well.
• Upgraded to OpenSSL 3.0.19.
• Added support for CentOS* Stream 10 and Red Hat* Enterprise Linux* 10.
• Bug fixes.

Intel® SGX SDK/PSW 2.27

Intel® Software Guard Extensions SDK includes the following changes in version 2.27.100.1:

• Upgraded to OpenSSL 3.0.17.
• Added support for Azure Linux 3.0, Debian 12 and Anolis 8.10.
• Improved logging output.
• Bug fixes.

Linux 2.26 Open Source Gold Release

Upgraded to OpenSSL 3.1.6.

Removed support for the MbedTLS Trusted Library.

Added support for Red Hat Enterprise Linux Server 9.4 (for x86_64) and SUSE Linux Enterprise Server 15.6 64-bits.

Added support for the FIPS 140-3 Certifiable OpenSSL Provider as an experimental feature.

Bug fixes.

Linux 2.25 Open Source Gold Release

Upgraded to OpenSSL 3.0.14.

Upgraded Intel(R) Integrated Performance Primitives (IPP) Cryptography library to version 2021.12.1.

Supported FIPS 140-3 Certifiable IPP Crypto based Trusted Library.

Upgraded Intel SGX Architecture Enclaves based on new IPP crypto library.

Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.14.

Removed Intel DCAP PCCS from repository.

Added Ubuntu* 24.04 LTS 64-bit Server support.
Fixed bug.

Note that PCCS is not available from this release. Please follow DCAP installation guide to use PCCSAdminTool to retrieve the attestation collaterals or use old version PCCS.

Linux 2.24 Open Source Gold Release

Upgraded to OpenSSL 3.0.13.

Upgraded to Intel(R) Integrated Performance Primitives (IPP) Cryptography library version 2021.11.

Upgraded to Protobuf 3.23.2.

Upgraded MbedTLS to 3.5.2.

Upgraded Intel DCAP Ring3 Abstraction Layer (R3AAL) library to support ConfigFS-TSM as communication channel between host and guest for TDX remote attestation.

Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.13.

Upgraded new TDX attestation result “TD_RELAUNCH_ADVISED” in Intel DCAP Quote Verification Library (QVL) and Appraisal Engine.

Fixed bugs.

Linux 2.23 Open Source Gold Release

Supported new OS: Ubuntu* 23.10 64-bit Server version.

Upgraded to OpenSSL 3.0.12.

Upgraded MbedTLS to 3.5.0.

Added SM2 encrypt/decrypt algorithm to the GM/SM (PRC National Commercialr Cryptographic Algorithms) sample code.

Introduced the Intel® DCAP Appraisal Engine within quote verification library, empowering users to evaluate verification results against diverse policies.

Upgraded Intel SGX Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.12.

Added Rust wrapper for quote provider library APIs.

Fixed bugs.

Linux 2.22 Open Source Gold Release

Upgraded to OpenSSL 3.0.10.

Added interoperable RA-TLS support which follows CCC design.

Enhanced Protect File System performance and added additional dependency libsgx_pthread.a.

Added the Constant Time instruction Decoder (CTD) into the default AEX-Notify mitigation handler in order to prevent the introduction of any additional subtle side channel leakages within the default handler.

Added Mistletoe 3 mitigations to the IPP Cryptography Library to the AES-ECB, AESGCM, and AES-CMAC algorithms. These have been incorporated transparently into the sgx_tcrypto library.

Resigned all Intel(R) SGX Architecture Enclaves.

Upgraded Intel SGX Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.10.

Added Attestation Library support for Intel(R) TDX Migration TD.

Added Rust wrapper for low-level Quote Generation APIs.

Enabled SE_TRACE log in release binary.

Updated Rust QVL wrapper to use native Rust structure for quote verification collateral.

Added a limitation in the DCAP QVL to only allow the user to set the QvE load policy once.

Fixed bugs.