runtime/src/consensus/registry: Add runtime encryption key (REK)

oasisprotocol · Jan 16, 2023 · c2843b0 · c2843b0
1 parent e00b0ac
commit c2843b0
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/.changelog/5137.internal.md b/.changelog/5137.internal.md
@@ -0,0 +1,4 @@
+runtime/src/consensus/registry: Add runtime encryption key (REK)
+
+Added REK to the node TEE capability descriptor to ensure old enclaves won't
+panic when new ones register with a non-nil REK.
diff --git a/runtime/src/consensus/registry.rs b/runtime/src/consensus/registry.rs
@@ -112,6 +112,10 @@ pub struct CapabilityTEE {
     /// Runtime attestation key.
     pub rak: PublicKey,
 
+    /// Runtime encryption key.
+    #[cbor(optional)]
+    pub rek: Option<[u8; 32]>,
+
     /// Attestation.
     pub attestation: Vec<u8>,
 }
@@ -894,6 +898,7 @@ mod tests {
                                    hardware: TEEHardware::TEEHardwareIntelSGX,
                                     rak: PublicKey::from("fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff8"),
                                     attestation: vec![0, 1,2,3,4,5],
+                                    ..Default::default()
                                }),
                             },
                             extra_info: Some(vec![5,3,2,1]),

diff --git a/runtime/src/consensus/state/registry.rs b/runtime/src/consensus/state/registry.rs
@@ -212,6 +212,7 @@ mod test {
                                    hardware: TEEHardware::TEEHardwareIntelSGX,
                                     rak: PublicKey::from("fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff8"),
                                     attestation: vec![0, 1,2,3,4,5],
+                                    ..Default::default()
                                }),
                             },
                             extra_info: Some(vec![5,3,2,1]),