mbedtls-SGX: a TLS stack in SGX
- use a wide array of cryptographic primitives (hash, RSA, ECC, AES, etc) in SGX.
- build SGX-secured tls clients and servers -- even OS cannot access session secrets.
- enjoy the awesome documentation and clean API of mbedtls.
In addition, mbedtls-SGX comes with examples to help you get started. Note that certain functionality is lost due to limitations of SGX. Read on for details.
Usage and Examples
mbedtls-SGX is a static enclave library. General steps of using mbedtls-SGX in your project are:
- compile and install mbedtls-SGX (see below)
trusted/mbedtls_sgx.edlin your enclave's EDL file.
- make sure your compiler can find the headers in
libmbedtls_sgx_u.ato the untrusted part of your application
libmbedtls_sgx_t.ato your enclave. Note that mbedtls-SGX needs to be linked in the same group with other SGX standard libs. Your Makefile (or CMakeLists.txt) needs something like
-Wl,--start-group -lmbedtls_sgx_t -lsgx_tstdc -lsgx_tcxx -l$(Crypto_Library_Name) -l$(Service_Library_Name) -Wl,--end-group
git clone https://github.com/bl4ck5un/mbedtls-SGX && cd mbedtls-SGX mkdir build && cd build cmake .. make -j && make install
Include the resultant
mbedtls_SGX-2.6.0 as part of your project.
mbedtls_SGX-2.6.0 ├── include │ └── mbedtls └── lib ├── libmbedtls_SGX_t.a ├── libmbedtls_SGX_u.a └── mbedtls_SGX.edl
To compile examples, run cmake with
cmake .. -DCOMPILE_EXAMPLES=YES make -j
Three examples will be built
s_client: a simple TLS client (by default it connects to
google.com:443, dumps the HTML page and exits)
s_server: a simple TLS server. You can play with it by
openssl s_client localhost:4433.
m_server: a multi-threaded TLS server, also listening at
Missing features and workarounds
Due to SGX's contraints, some features have been turned off.
- The lack of trusted wall-clock time. SGX provides trusted relative timer but not an absolute one. This affects checking expired certificates. A workaround is to maintain an internal clock and calibrate it frequently.
- No access to file systems: mbedtls-SGX can not load CA files from file systems. To work this around, you need to hardcode root CAs as part of the enclave program. See
example/enclave/ca_bundle.hfor an example.
mbedtls-SGX is open source under Apache 2.0. See LICENSE for more details.