Intel SGX/TDX Platform Ownership Endorsement Tools (Intel SGX/TDX POE Tools)

Introduction

This repository contains tools and libraries related to Intel's Platform Ownership Endorsement (POE) flow for Intel® SGX and Intel® TDX platforms.

A Platform Ownership Endorsement is a signed statement, issued by a platform owner, that binds a platform's identity to that owner. It lets a relying party cryptographically verify who has physical possession of a Confidential Computing platform, mitigating risks from physical attacks such as TEE.Fail.

The repository provides two command-line tools and one C++ library:

Component	Purpose
poe-gen-tool	Extracts platform identities and generates/signs POE CoRIMs
poe-eval-tool	Verifies a signed POE CoRIM against a TEE quote and identifies the platform owner
poe-eval-lib	C++ library implementing the core POE verification logic; poe-eval-tool is built on top of it, and applications can embed it directly

poe-shared is an additional internal library (logging, config-path resolution, hex/timestamp formatting, quote parsing, etc.) shared by all three components above; it has no public API of its own and no dedicated README.

Build

Prerequisites: CMake 3.20+, a C++20 compiler (GCC 11+), and a C compiler + make.

The simplest way to build everything (all three components, tests included) is the top-level Makefile:

make              # release build of every component
make DEBUG=1      # debug build
make test         # build + run every component's unit tests

Build a single component (useful while iterating):

make poe-gen-tool          # just the poe-gen-tool binary
make poe-eval-tool         # just the poe-eval-tool binary
make poe-eval-lib          # just the poe-eval-lib static/shared libraries
make test_poe-gen-tool     # build + run only that component's tests

Packaging and coverage:

make deb                   # .deb packages for poe-gen-tool + poe-eval-tool + poe-eval-lib
make rpm                   # .rpm packages for poe-gen-tool + poe-eval-tool + poe-eval-lib
make standalone_packages   # standalone tarballs (poe-gen-tool, poe-eval-tool; no package manager needed)
make coverage               # instrumented build + lcov HTML report
make clean                  # clean build outputs
make distclean               # remove the entire build directory

The Makefile defaults to Release and places build artefacts under build/Release/ (or build/Debug/ with DEBUG=1) — binaries in bin/; poe-eval-lib's static archive (libintel_dcap_poe_cxx.a) lands under poe-eval-lib/ instead (e.g. build/Release/poe-eval-lib/).

Direct CMake is a separate workflow. Configure from the repository root with cmake -S . -B build and build with cmake --build build; for single-config generators, omitting CMAKE_BUILD_TYPE defaults to Debug, with binaries and libraries under build/bin/ and build/lib/. See poe-gen-tool/BUILD.md for direct-CMake examples.

Tools and libraries

Intel® Platform Ownership Endorsement Generator (Intel® POE Generator)

Used by a platform owner to extract platform identities (from a Platform Manifest, PCK Certificate, or SGX/TD Quote) and to generate and sign the resulting Platform Ownership Endorsement.

For more details, see the tool's README.md.

Intel® Platform Ownership Endorsement Evaluator (Intel® POE Evaluator) - Tool

Used by a relying party to verify a signed POE CoRIM against a TEE quote and determine the identified platform owner.

For more details, see the tool's README.md.

Intel® Platform Ownership Endorsement Evaluator (Intel® POE Evaluator) - Library

A C++ library implementing the core POE verification logic behind an embeddable API (IdentifyPlatformOwner). poe-eval-tool itself is built on top of this library, adding CLI concerns such as trust anchor verification and config-file handling; applications that need to perform POE verification in-process, without shelling out to the CLI tool, can embed the library directly.

For more details, see the library's README.md.

License

This project is licensed under the BSD 3-Clause license. See License.txt for details.

Contributing

See CONTRIBUTING.md for details.