Runnung Vaultwarden on SGX with a Secure Database like EdgelessDB

[Vad1mo]

I would be beneficial for security if Vaultwarden had a description on how to make it run on intel SGX2 hardware including the DB.

EdgelessDB is an open-source MySQL-compatible database for confidential computing. EdgelessDB runs entirely inside runtime-encrypted Intel SGX enclaves. In contrast to other databases, EdgelessDB ensures that all data is always encrypted—in memory as well as on disk. EdgelessDB has no storage constraints and delivers close to native performance.

[BlackDex]

In which sense would this increase the security? All received and send by Vaultwarden is already encrypted by the client.
So, I'm not seeing the extra benefits for this specifically my self.
If you know a specific use-case for Vaultwarden please enlighten me.

[Vad1mo]

IMO it would better protect Vaultwarden on VPS offerings from vulnerabilities similar to Meltdown and Spectre

[BlackDex]

Still, Vaultwarden doesn't handle secrets or knows master passwords.

[kpfleming]

And in case you haven't noticed, SGX itself is far some secure... It's debatable whether the effort to support storing the data in an SGX enclave would be a good investment.

[x86pup]

Signal seems to use Intel SGX (albeit only on server motherboards and not standard consumer ones, and not vouching for the article posted as this is widely known but the author is quite biased), but I'm going to have to agree with the above. Intel SGX just recently had another round of severe vulnerabilities and this is a very frequent recurring theme with Intel SGX.

Even if there is a valid use case for a secure enclave here, I don't think it should be used or trusted for handling secrets or confidential data at this point.

[jjlin]

If it's MySQL-compatible, it might pretty much work with Vaultwarden's existing MySQL backend support. You're welcome to test it and document anything needed to get it working at https://github.com/dani-garcia/vaultwarden/wiki/Using-the-MariaDB-%28MySQL%29-Backend.

[BlackDex]

If it's only the database, and MySQL compatible, that should be fine indeed. But making changes to Vaultwarden to support SGX is probably too much. I think Vaultwarden will run just fine on such hardware, it just doesn't use SGX features.

But indeed, if that database application works, just mention it on the wiki 🙂