Intel® SGX SDK 2.30

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Intel® Software Guard Extensions SDK
  • Intel SGX SDK source code (including samples) as well as the SGX enclave runtime libraries now reside at intel/confidential-computing.sgx.sdk and is referenced as a submodule from intel/confidential-computing.sgx.
  • Updated Intel® Cryptography Primitives Library (CPL) dependency to 2.2.0, including updating components to use new APIs and structures where applicable. Building from source now requires NASM ≥ 2.16.02.
  • Enabled an option to build Intel® Cryptography Primitives libraries from source instead of using prebuilt binaries.
  • Embedded SDK version in the installed buildenv.mk.
  • Removed Intel optimized string/math library build option (USE_OPT_LIBS=2 and USE_OPT_LIBS=3). The SDK now builds exclusively with open-source string and math implementations; the CPL-based SDK build (USE_OPT_LIBS=1) remains the default. The legacy build flavors are available in the v2.29 release archive.
• Sample projects
  • Removed the SampleDNNL sample and its DNNL dependency (oneDNN v1.1.1, Oct 2019) from the SDK repository. The archived sample remains accessible in the v2.29 release tag.
  • Added direction bit in GCM IV to prevent nonce reuse in Local Attestation sample.
• Other changes
  • Updated supported operating systems:
    • Added Red Hat* Enterprise Linux* Server 9.6, 9.8, 10.0, and 10.2; removed 9.4.
    • Updated SUSE* Linux Enterprise Server support to 15 SP7 and 16; removed 15.6.
    • Added Debian* 13.
  • Security hardening and bug fixes.

Note

Deprecation notice — USE_OPT_LIBS=0 (OpenSSL/SGXSSL crypto build option).
Intel plans to deprecate the OpenSSL-based (USE_OPT_LIBS=0) crypto build flavor of the SGX SDK and to remove it in a future release.
The default, CPL-based build (USE_OPT_LIBS=1) is unaffected and remains the recommended configuration.
If you rely on USE_OPT_LIBS=0, please see the migration guidance below and let us know via a GitHub issue if this affects you.

Migration guideline

• If you built with USE_OPT_LIBS=0 only to get a working SDK → drop the flag and build the default (make sdk, i.e. USE_OPT_LIBS=1).
  The sgx_tcrypto API and sgx_tcrypto.h header are identical; no enclave source changes are required, only the backing implementation (CPL instead of OpenSSL) differs.
• If you need OpenSSL's wider libcrypto inside the enclave → build the standalone Intel SGX SSL project (intel/intel-sgx-ssl) from source and link libsgx_tsgxssl + libsgx_tsgxssl_crypto into your enclave.
  This is independent of how the SDK was built, works alongside the default CPL-based SDK (both crypto libraries can coexist), and is already the supported way to use OpenSSL crypto in an enclave.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS* Stream	SUSE*	Anolis OS*	Azure Linux*
SDK installer	- 22.04 - 24.04 - 26.04	- 10 - 12	- 9.6 - 9.8 - 10.0 - 10.2	- 9 - 10	- 15.7 - 16	- 8.10	- 3.0
Local repo DEB/RPM packages	- 22.04 - 24.04 - 26.04	- 10 - 12	- 9.6 - 9.8 - 10.0 - 10.2	- 9 - 10	- 15.7 - 16	- 8.10	- 3.0

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

Intel® SGX SDK 2.29 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Added Ubuntu 26.04 support.
  • Build dependencies updated to support GCC 15 while remaining backward compatible.
  • Enabled support for CMake 4+.
  • Deprecated and removed the Intel® Software Guard Extensions (Intel® SGX) Eclipse* plug-in from the Intel® Software Guard Extensions SDK (Intel® SGX SDK) source code. The last available version can be downloaded from SGX 2.28 release directory.
• Relocated SGX SDK–related code from the DCAP repository into the SGX SDK repository layout:
  • The Trusted Verification Library (TVL) is part of the Intel SGX SDK distribution.
  • sgx_qve_header.h is distributed with the libsgx-headers package.
• Common structure definitions (tee_policy_bundle_t, tee_policy_auth_result_t) shared between SGX (TVL) and DCAP were extracted to a new header, sgx_dcap_qal_types.h. This header is now part of the Intel SGX repository and is included by DCAP’s sgx_dcap_qal.h.
• Security hardening: Added compiler and linker security flags across buildenv.mk and all SDK component Makefiles.
• Updated Protobuf to 33.4; updated Abseil dependency to 20250512.1.
• Bug fixes.

Note

In the next release, the SGX SDK codebase will be moved to a standalone GitHub repository. The SGX repository will reference the SDK via a Git submodule.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS* Stream	SUSE*	Anolis OS*	Azure Linux*
SDK installer	- 22.04 - 24.04 - 26.04	- 10 - 12	- 9.4 - 10.0	- 9 - 10	- 15.6	- 8.10	- 3.0
Local repo DEB/RPM packages	- 22.04 - 24.04 - 26.04	- 10 - 12	- 9.4 - 10.0	- 9 - 10	- 15.6	- 8.10	- 3.0

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.29.

Intel® SGX SDK 2.28 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Removed deprecated functionality based on EPID (Enhanced Privacy ID), including EPID remote attestation.
  • • Note support remains for ECDSA-based attestation and universal quoting APIs (i.e. sgx_get_quote_ex()).
    • The following definitions have been removed from libsgx-headers:
      • sgx_calc_quote_size()
      • sgx_check_update_status()
      • sgx_get_extended_epid_group_id()
      • sgx_get_quote()
        • note: sgx_get_quote_ex() remains supported
      • sgx_get_quote_size()
        • note: sgx_get_quote_size_ex() remains supported
      • sgx_init_quote()
        • note: sgx_init_quote_ex() remains supported
      • sgx_report_attestation_status()
    • The following dev header has been removed: sgx_uae_epid.h
    • Removed libsgx_epid_sim.so (the EPID simulation library).
• Removed code supporting the deprecated Launch Enclave, whitelist management and out-of-tree driver.
  • • The recommended launch mechanism continues to be the Flexible Launch Control via the in-kernel SGX driver.
    • The following launch-related UAE APIs are deprecated and will now return SGX_ERROR_FEATURE_NOT_SUPPORTED:
      • get_launch_token()
      • sgx_get_whitelist()
      • sgx_get_whitelist_size()
      • sgx_register_wl_cert_chain()
    • The following dev header has been deprecated: sgx_uae_launch.h
    • The following parameters of sgx_create_enclave() URTS API: *launch_token and *launch_token_updated are now RESERVED and ignored by the implementation. Implementers may choose to continue passing an empty/initialized launch_token_t placeholder or pass a nullptr in their place.
    • Removed libsgx_launch_sim.so (the Launch Enclave simulation library).
• Enclave creation no longer fails when the Enclave Dynamic Memory Management (EDMM) and AEX-Notify are both enabled.
• Upgraded to OpenSSL 3.0.19.
• Added support for CentOS* Stream 10 and Red Hat* Enterprise Linux* 10.
• Bug fixes.

Note

Intel® Software Guard Extensions (Intel® SGX) Eclipse plugin will be removed in the next release of Intel® SGX SDK.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS* Stream	SUSE*	Anolis OS*	Azure Linux*
SDK installer	- 22.04 - 24.04	- 10 - 12	- 9.4 - 10.0	- 9 - 10	- 15.6	- 8.10	- 3.0
Local repo DEB/RPM packages	- 22.04 - 24.04	- 10 - 12	- 9.4 - 10.0	- 9 - 10	- 15.6	- 8.10	- 3.0

• Eclipse* plug-in: 2.28

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.28.

Intel® SGX SDK 2.27 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Upgraded to OpenSSL 3.0.17.
• Added support for Azure Linux 3.0, Debian 12 and Anolis 8.10.
• Improved logging output.
• Bug fixes.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS* Stream	SUSE*	Anolis OS*	Azure Linux*
SDK installer	- 22.04 - 24.04	- 10 - 12	- 9.4	- 9	- 15.6	- 8.10	- 3.0
Local repo DEB/RPM packages	- 22.04 - 24.04	- 10 - 12	- 9.4	- 9	- 15.6	- 8.10	- 3.0

• Eclipse* plug-in: 2.27

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.27.

Intel® SGX SDK 2.26 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Upgraded to OpenSSL 3.1.6.
• Removed support for the MbedTLS Trusted Library.
• Added support for Red Hat* Enterprise Linux* Server 9.4 (for x86_64) and SUSE* Linux* Enterprise Server 15.6 64-bits.
• Added support for the FIPS 140-3 Certifiable OpenSSL Provider as an experimental feature.
• Bug fixes.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS* Stream	SUSE*	Azure Linux*
SDK installer	- 22.04 - 24.04	- 10 - 12	- 9.4	- 9	- 15.6	- 3.0
Local repo DEB/RPM packages	- 22.04 - 24.04	- 10 - 12	- 9.4	- 9	- 15.6	- 3.0
Driver DCAP 1.41	- 22.04 - 24.04	- 10 - 12	- 9.4	- 9	- 15.6	- 3.0

• Eclipse* plug-in: 2.26

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.26.

Intel® SGX SDK 2.25 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Upgraded to OpenSSL 3.0.14.
• Upgraded Intel® Integrated Performance Primitives (IPP) Cryptography library to version 2021.12.1.
• Supported FIPS 140-3 Certifiable IPP Crypto based Trusted Library.
• Added Ubuntu* 24.04 LTS 64-bit Server support.
• Fixed bugs.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS*	CentOS* Stream	SUSE*	Anolis OS*
SDK installer	- 20.04 - 22.04 - 24.04	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6
Local repo DEB/RPM packages	- 20.04 - 22.04 - 24.04	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6
Driver out-of-tree 2.11	- 20.04 - 22.04 - 24.04	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6
Driver DCAP 1.41	- 20.04 - 22.04 - 24.04	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6

• Eclipse* plug-in: 2.25

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.25.

Intel® SGX SDK 2.24 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Upgraded to OpenSSL 3.0.13.
• Upgraded to Intel® Integrated Performance Primitives (IPP) Cryptography library version 2021.11.
• Upgraded to Protobuf 3.23.2.
• Upgraded MbedTLS to 3.5.2.
• Fixed bugs.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS*	CentOS* Stream	SUSE*	Anolis OS*	CBL- Mariner*
SDK installer	- 20.04 - 22.04 - 23.10	- 10 - 12	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Local repo DEB/RPM packages	- 20.04 - 22.04 - 23.10	- 10 - 12	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Driver out-of-tree 2.11	- 20.04 - 22.04 - 23.10	- 10 - 12	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Driver DCAP 1.41	- 20.04 - 22.04 - 23.10	- 10 - 12	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download

• Eclipse* plug-in: 2.24

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.24.

Intel® SGX SDK 2.23 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Supported new OS: Ubuntu* 23.10 64-bit Server version.
• Upgraded to OpenSSL 3.0.12.
• Upgraded MbedTLS to 3.5.0.
• Added SM2 encrypt/decrypt algorithm to the GM/SM (PRC National Commercial Cryptographic Algorithms) sample code.
• Fixed bugs.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS*	CentOS* Stream	SUSE*	Anolis OS*	CBL- Mariner*
SDK installer	- 20.04 - 22.04 - 23.10	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Local repo DEB/RPM packages	- 20.04 - 22.04 - 23.10	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Driver out-of-tree 2.11	- 20.04 - 22.04 - 23.10	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Driver DCAP 1.41	- 20.04 - 22.04 - 23.10	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download

• Eclipse* plug-in: 2.23

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.23.

Intel® SGX SDK 2.22 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Upgraded to OpenSSL 3.0.10.
• Added interoperable RA-TLS support which follows CCC design.
• Enhanced Protected File System performance and added additional dependency libsgx_pthread.a.
• Added the Constant Time instruction Decoder (CTD) into the default AEX-Notify mitigation handler in order to prevent the introduction of any additional subtle side-channel leakages within the default handler.
• Added Mistletoe 3 mitigations to the IPP Cryptography Library to the AES-ECB, AES-GCM, and AES-CMAC algorithms. These have been incorporated transparently into the sgx_tcrypto library.
• Enabled SE_TRACE log in release binary.
• Fixed bugs.

Note

When utilizing the trusted cryptography library with SGXSSL/OpenSSL 3, it's necessary to adjust the value in the enclave signing configuration XML file, specifically within the <HeapMaxSize> tag. This adjustment is particularly important for enclaves that involve multiple threads.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS*	CentOS* Stream	SUSE*	Anolis OS*	CBL- Mariner*
SDK installer	- 20.04 - 22.04	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Local repo DEB/RPM packages	- 20.04 - 22.04	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Driver out-of-tree 2.11	- 20.04 - 22.04	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download
Driver DCAP 1.41	- 20.04 - 22.04	- 10	- 9.2	- 8.3	- 9	- 15.4	- 8.6	- download

• Eclipse* plug-in: 2.22

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.22.

Intel® SGX SDK 2.21 [ref]

Intel® Software Guard Extensions SDK (Intel® SGX SDK)

• Upgraded to OpenSSL 1.1.1u.
• Fixed bugs.

Note

This is the final release that will support Ubuntu 18.04 LTS. The next release of this software will not include pre-built packages for Ubuntu 18.04 LTS, aligning with Ubuntu's LTS release Standard Support policy.

📦  Download information

   (click to expand)

Downloads

	Ubuntu*	Debian*	RHEL*	CentOS*	CentOS* Stream	SUSE*	Anolis OS*
SDK installer	- 18.04 - 20.04 - 22.04	- 10	- 8.6	- 8.3	- 8	- 15.4	- 8.6
Local repo DEB/RPM packages	- 18.04 - 20.04 - 22.04	- 10	- 8.6	- 8.3	- 8	- 15.4	- 8.6
Driver out-of-tree 2.11	- 18.04 - 20.04 - 22.04	- 10	- 8.6	- 8.3	- 8	- 15.4	- 8.6
Driver DCAP 1.41	- 18.04 - 20.04 - 22.04	- 10	- 8.6	- 8.3	- 8	- 15.4	- 8.6

• Eclipse* plug-in: 2.21

💡 TIP: Ubuntu* packages are also served from the live Intel® SGX APT repository at https://download.01.org/intel-sgx/sgx_repo/ubuntu.

---

Caution

Reference-only snapshot — predates this repository (extracted from the Intel® SGX for Linux repository). These sources mirror the SDK at this point, but the build system isn't adapted to the standalone layout; to rebuild, use the matching SGX-side tag sgx_2.21.