Previously, RA-TLS was recommended to be used with LD_PRELOAD trick.
However, LD_PRELOAD is too hacky and shouldn't be used to preload
libraries to an executable (in contrast to its normal use of
replacing functions from one library with another). This commit
removes any mentions of LD_PRELOAD trick from RA-TLS, and
replaces LD_PRELOAD with `dlopen()` in ra-tls-mbedtls example.
Secret Provisioning provides a simple interface for enclavized
applications to connect to a trusted secret-provisioning service and
securely pass the secrets inside the SGX enclave. The application acts
as a client and the secret-provisioning service as a server. They
establish a TLS session via mutual authentication, where the service
sends a classical X.509 certificate and the application sends an
RA-TLS X.509 certificate. After the service verifies the RA-TLS
certificate and its SGX-related information, it provisions secrets
to the application. The TLS session may continue to be used by the
application and the server after the initial provisioning. Secret
Provisioning feature relies heavily on RA-TLS.
Secret Provisioning is shipped as three libraries:
- secret_prov_attest.so: creates RA-TLS X.509 certificate with SGX
quote embedded and sends it to the secret-provisioning service as
part of mutual attestation of TLS session. Linked into enclavized
applications. Not thread-safe.
- secret_prov_verify_epid.so: establishes a TLS session with mutual
attestation, verifies received RA-TLS certificate, and sends secrets
back to the enclavized application. Linked into secret-provisioning
service. Verifies RA-TLS certificate using EPID-based flows.
Multi-threaded and thread-safe (new thread for each client).
- secret_prov_verify_dcap.so: same as secret_prov_verify_epid.so but
verifies RA-TLS certificate using ECDSA/DCAP-based flows.
Multi-threaded and thread-safe (new thread for each client).
This commit also adds two Secret Provisioning examples, with a minimal
enclavized app, a more complicated enclavized app, and a single
secret-provisioning service. These examples are added to Jenkins.
LMbench was causing a lot of problems in the past and we just noticed
another one (the last one from the list below), which broke the
camel's back :)
Some of the issues:
- Original mirrors are unstable.
- Its source is terrible.
- It's not portable (e.g. needs custom patches to run on Fedora).
- Runs for quite long in CI (a few minutes).
- The last update to the project was 15 years ago (13 on dev branch).
- It uses some features not implemented in Graphene
(getrusage(RUSAGE_SELF, ...)) without checking for errors, which leads
to reporting bogus times.
- Actually, it silently skips failures, because the command is piped to
`tee` and then `tee`'s exit code is checked instead of the original
command's.
We don't use it in tests, plus it didn't work on SGX - there was a
warning about autogeneration inserted before the autogenerated shebang.
Also, test_106_manifest_with_shebang didn't actually test the shebang
but ran the binary through the loader, so it was meaningless. We'll need
to fix it and implement again after cleaning up Graphene invocation.
Running `make` without arguments (as advertized in the README)
previously resulted in "make: *** No rule to make target 'all'", because
of ".DEFAULT_GOAL := all" in Scripts/Makefile.Host.
RA-TLS integrates Intel SGX remote attestation into the TLS connection
setup. Conceptually, it extends the standard X.509 certificate with
SGX-related information. The additional information allows the receiver
(verifier) of the certificate to verify that it is indeed communicating
with an SGX enclave (attester). RA-TLS is shipped as three libraries:
- ra_tls_attest.so: creates self-signed RA-TLS X.509 certificate with
SGX quote embedded; typically linked into server apps.
- ra_tls_verify_epid.so: verifies RA-TLS certificate by sending SGX
quote to IAS and verifying attestation report from IAS; typically
linked into client apps.
- ra_tls_verify_dcap.so: verifies RA-TLS certificate by providing SGX
quote v3 to the libsgx_dcap_quoteverify library and relying on its
assessment of the quote; typically linked into client apps.
This commit also adds an RA-TLS example using simple mbedTLS server
and client. The server generates the RA-TLS certificate, and the client
connects to the server, verifies this certificate, and performs a
dummy HTTP request. This example is added to Jenkins.
Also, add library paths so that lmbench now also works on Fedora.
This should now work on both Fedora and Ubuntu 18.04 and also when
libtircp is not installed, so we can patch unconditionally.
- This example will be compared with another example for loading
encrypted models and inputs using PFS. Thus, load the model from a file.
- Updated Makefile and README.md
The documentation currently specifies SGX_SIGNER_KEY as the parameter to
enable Graphene to find your keys.
Some examples don't use an environment parameter at all for the key to
sign the enclave, this commit fixes that.
The documentation currently specifies SGX_SIGNER_KEY as the parameter to
enable Graphene to find your keys.
Some examples don't use this environment parameter, this commit fixes
that.
On Ubuntu 'which' finds 'cp' in '/bin/cp' and on Fedora in
'/usr/bin/cp'. Rather than hard-coding the path '/bin', use
$(EXECDIR) and derive its value from the dirname of the path of the
executable, i.e., either '/bin' or '/usr/bin'.
Adapt the python constants so that python-simple also works on
Fedora 31. python-scipy-insecure misses some shared libraries on
Fedora 31, so it does not work there yet.
Adapt Scripts/Makefile.configs so that we can build and test on
Fedora. Most of the tests in Examples are now also runable on
Fedora. Also add a dependency installation target for Fedora to
TensorFlow example.
Unescape the '\n' as a newline when writing it into the nginx config
file rather than writing it as '\n'. Use printf rather than
`/bin/echo -e` since this seems to work for all distros.
Extend Makefile.configs and define several variables for make to use
derived from 'gcc -dumpmachine'. In particular:
- ARCH as the architecture, e.g., x86_64
- ARCH_LONG as the long version of the architecture, e.g., x86_64-linux-gnu
- ARCH_LIBDIR as the directory where libraries are located,
e.g., /lib/x86_64-linux-gnu
In Makefiles and manifest templates, replace the hard-coded
x86_64-linux_gnu and /lib/x86_64-linux-gnu through these variables.
Extend the already existing sed scripts to replace the necessary
variables.
Michał Kowalczyk