title: How MRENCLAVE value works in intel SGX remote attestation?
body: <p>I wonder how MRENCLAVE value works in intel SGX remote attestation. I found that</p>
  <blockquote>
  <p>&quot;MRENCLAVE uniquely identifies any particular enclave, so using the Enclave Identity will restrict access to the sealed data only to instances of that enclave. NOTE: Different builds/versions of an enclave will result in a different MRENCLAVE value.&quot; (<a href="https://software.intel.com/en-us/blogs/2016/05/04/introduction-to-intel-sgx-sealing" rel="nofollow noreferrer">https://software.intel.com/en-us/blogs/2016/05/04/introduction-to-intel-sgx-sealing</a>)</p>
  </blockquote>
  <p>In my understanding, MRENCLAVE is used for client to check if received MRENCLAVE from service provider and intended MRENCLAVE that client generated are same. If not, then how can we check if service provider executes intended code and data in remote attestation?</p>
  <p>I mean, Alice has enclave code and its MRENCLAVE(snapshot of code and data), then request to Bob to execute it. Then how can Alice check if  Bob execute the exact intended code with quote Bob sent? I thought MRENCLAVE does it</p>