-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Design an attestation syscall #966
Comments
@npmccallum you know more about the preferred key / cert formats |
|
Not everybody likes to use ASN.1/DER, but from the POV of an interface having a standard and extensible format is definitely a good thing. I expect this to be extended relatively soon for PQC private key definitions as soon as they get standardized by a standards body after NIST's competition has winners. And this format should allow to describe those too. |
@npmccallum - fixed... You are right, we can treat the buffers as opaque byte slices in the shims. Only the Loader and the Payload (wasmtime) need to share a serde |
Using
Is my understanding correct that the private key is used sorely for signing a Wasm workload? |
To be discussed: Should the data be consumable from |
@simo5 Agreed. In this case, the private key delivered over this mechanism becomes the foundation for a self-signed TLS cert. So we don't really have a choice about ASN.1/DER. |
If it is a self-signed cert you are after ... why don't you just generate the private key in the keep and share out the certificate with the public key ? |
No. Enarx deployment is three-phase:
During the deployment phase is where the tenant validates the attestation (before delivering code and data). All of the necessary data for the tenant to validate the host attestation is contained in the Keep's TLS certificate. This comes in two flavors. In the pre-attestation flavor, the tenant securely delivered the private key to the keep during the provisioning phase. Therefore, the tenant knows the public key of the TLS certificate it expects. In the post-attestation flavor, the per-hardware attestation metadata is contained in an X.509 certificate extension. The tenant can validate that the attestation metadata is (1) valid and (2) bound to the Keep's public key. This proves that the private key for the Keep's certificate was generated inside a hardware enforced keep. In short, the |
That's basically what we do in the post-attestation case. This depends on the ability to bind the public key to the attestation process. For pre-attestation, the attestation process concludes before the Keep is executing. Therefore, there is no opportunity to generate a keypair before attestation concludes. Both AMD SEV (pre-SNP) and IBM POWER PEF are pre-attestation workflows.
This would be in some regards simpler. However, it also means that the tenant has to keep a secret as state versus keeping public key material as state. Disclosure of a symmetric key means that anyone can spoof a Keep to that tenant. The idea here is that the tenant generates the keypair, delivers the private key and then retains only the public key. This reduces the attack surface under the conditions that the attacker has the ability to read tenant state. (Keep in mind that this state might be stored in something like etcd.) |
Yes. I propose the following syscall interface: Inputs
Outputs
Special CaseWhen
|
I meant the serialized opaque buffer. |
I presume the output buffer? Its contents are dictated by the technology. |
@haraldh The |
I don't think so. Although for the syscall it is transparent, we might want to specify some kind of format in the future. |
This has been demonstrated. I will move its contents into our wiki and close this issue. edit: This has been moved to the wiki. |
according to enarx#966 Signed-off-by: Harald Hoyer <harald@profian.com>
according to enarx#966 Signed-off-by: Harald Hoyer <harald@profian.com>
according to enarx#966 Signed-off-by: Harald Hoyer <harald@profian.com>
according to enarx#966 Signed-off-by: Harald Hoyer <harald@profian.com>
according to enarx#966 Signed-off-by: Harald Hoyer <harald@profian.com>
according to #966 Signed-off-by: Harald Hoyer <harald@profian.com>
Attestation Syscall - User Space
syscall number
0xEA01
NAME
get_attestation - get the attestation from the CPU
SYNOPSIS
For
C
Note: a
C
wrapper has to store the second return value inrdx
intotechnology
and a negativerax
in errno.RETURN VALUE
On error a negative number is returned as
-errno
.On success, this call returns the number of bytes placed in buf.
technology
is filled in withLOW LEVEL INTERFACE
Inputs
rdi
- input data buffer (const)rsi
- input data buffer lengthrdx
- output data bufferr10
- output data buffer lengthOutputs
rax
- number of bytes written or negative errno (per Linux convention)rdx
- TEE technology identifier (enum)Special Case
When
rdx
(input) is0
(i.e.NULL
):r10
is ignoredFormat of
buf
Serialization is done on the host and deserialization is done in the Wasmtime code payload. Both have access to full
std
, soall features of
serde
should be used to ensure a safe data transfer from the untrusted host data.rdx
ortechnology
from thegetatt()
call decides which of the union members to use.Example union for
buf
:Suggested serde formats:
ERRORS
EFAULT: buf extends outside the process's allocated address space.
EINVAL: bufsiz is not positive.
EIO: an error occurred getting the attestation
EMSGSIZE: provided buffer too small
Attestation Syscall - Shim to Host
Because the method of attestation differs for every architecture, the internal syscall handling differs for each.
SEV - pre attestation - Shim
buf
provided to the host is the shim physical address, where the host places encrypted bytes received from the tenant.This is not an address in the unencrypted
sallyport::Block
.The shim validates the returned slice length and copies the
buf
from encrypted address space to the userspacebuf
.SEV - pre attestation - Host
The Loader gets a private key (encrypted with the attestation) from the tenant and places the encrypted bytes
at the address given by the shim.
SGX - post attestation - Shim
No special handling besides the usual is needed.
SGX - post attestation - Host
The Loader requests the attestation with the nonce included and places the result at the address given by the shim.
The text was updated successfully, but these errors were encountered: