Measure and attest SGX contents

[npmccallum]

Depends on #82.

[lkatalin]

SGX attestation-related tasks (related to #824 ):

These are tasks that can be done without the communication channels between enclave and client established yet.

Enclave side (generating the attestation Report):

• Receive and handle an attestation request from client in code layer
• Detect whether payload is running in SGX or SEV Payload should detect whether it's running in a TEE #671 Implement stub for getatt() pseudo-syscall (code => shim) in SGX enarx-archive/enarx-keepldr#90
• Implement getatt() synthetic syscall enarx/enarx-keepldr#31
• Generate a Report for the current enclave using EREPORT Generate an SGX Report #727
• Generate a Diffie-Hellman keys **
• Embed DH pub key in the Report **
• Get Intel's QE working with the current driver Get Intel's QE working with the current driver #912
• Get the QE's target info and pass it to the enclave to create the Report Obtain TargetInfo from Intel's QE and use it to generate a Report #913 Implement logic for sgxatt() pseudo-syscall in SGX enarx-archive/enarx-keepldr#92
• Have the QE verify the Report Locally verify the SGX Report to create a Quote #914

Enarx Client Agent side (verifying a Quote):

• Create an attestation request (to be later sent to enclave side)
• Retrieve a PCK cert chain from Intel’s service Retrieve Intel's PCK cert chain #789
• Check validity of the PCK cert chain
• Verify a dummy Quote:
  • Parse the Quote: get measurement, PCK leaf cert, signatures, etc.
  • Verify PCK is correct via PCK cert chain
  • Verify AK is correct via PCK
  • Verify AK signature on measurement is correct
  • Verify measurement is expected
• Generate Diffie-Hellman keys **

** = Requires further discussion / RFC underway

Some of this code can be used as reference from 2019's attestation demo.

[platten]

Closing in lieu of #1212