-
Notifications
You must be signed in to change notification settings - Fork 51
/
doc.go
59 lines (50 loc) · 2.13 KB
/
doc.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
// Copyright (c) Edgeless Systems GmbH.
//
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at https://mozilla.org/MPL/2.0/.
/*
Package enclave provides functionality for Go enclaves like remote attestation and sealing.
# Using remote reports
Remote reports are generated by an enclave platform to attest the integrity and
confidentiality of an enclaved app instance. A remote report also attests that an app was
indeed established on a secure enclave platform. It is targeted to a remote third party
which is not running on an (or not on the same) enclave platform.
A remote report can contain 64 bytes of additional data, e.g., data that was created
by the enclaved application or data the enclaved app received. This data (or its hash)
can be included as reportData.
GetRemoteReport creates a remote report which includes additional reportData. The following
code can be run by an enclaved app:
// Create a report that includes the hash of an enclave generated certificate cert.
hash := sha256.Sum256(cert)
report, err := enclave.GetRemoteReport(hash[:])
if err != nil {
return err
}
VerifyRemoteReport can be used by a third party to verify the previously generated remote
report. While VerifyRemoteReport verifies the report's integrity and signature, the third
party must additionally verify the content of the remote report:
report, err := enclave.VerifyRemoteReport(report)
if err != nil {
return err
}
if report.SecurityVersion < 2 {
return errors.New("invalid security version")
}
if binary.LittleEndian.Uint16(report.ProductID) != 1234 {
return errors.New("invalid product")
}
if !bytes.Equal(report.SignerID, signer) {
return errors.New("invalid signer")
}
if report.Debug {
return errors.New("debug enclave not allowed")
}
// certBytes and report were sent over insecure channel
hash := sha256.Sum256(certBytes)
if !bytes.Equal(report.Data[:len(hash)], hash[:]) {
return errors.New("report data does not match the certificate's hash")
}
// we ensured the cert was generated by the enclave
*/
package enclave