apache / apache/teaclave-sgx-sdk

example request: static-data-distribution with sealed rsa key

Open
#74 13 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
1.2k
Forks
268
PR merge metrics
No merged PRs in 30d

Description

I've been playing around with sealeddata and static-data-distribution. The latter is a very interesting example but quite meaningless because the rsa key is written to file in cleartext. I've tried to combine this with sealeddata the following way, also solving trusted provisioning:

app calls generate_keys() enclave function, which:
1. generates rsa keypair
2. seals keypair
3. writes sealed keypair to file
4. returns pubkey

the app can then
1. encrypt some cleartext with the enclave pubkey
2. send the ciphertext to enclave which reads the rsa keypair from file and decrypts and prints the ciphertext

IMO this would be meaningful and close to a real use case.

However, I'm struggling with various approaches :
**try1**
```
//enclave/src/lib.rs
...
let rsa_keypair = Rsa3072KeyPair::new().unwrap();
let rsa_key_json = serde_json::to_string(&rsa_keypair).unwrap();
let result = SgxSealedData::::seal_data(&aad, &rsa_key_json);
let _sealed_rsa_keypair = match result {
Ok(x) => x,
Err(ret) => { return ret; },
};
let sealed_rsa_key_json = serde_json::to_string(&_sealed_rsa_keypair).unwrap();
...
```
sgx_tseal::SgXSealedData doesn't implement traits Serialize, Deserialize, so I can't use json

**try2**
another approach is to generate rsa keypair deterministically from a seed, but your sgx_crypto_helper functions do not allow this (would be a nice feature ;-).

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in the static-data-distribution example and the enclave/src/lib.rs code shown in the issue, then read the sealeddata APIs and SgxSealedData limitations. Compare the proposed generate_keys flow with the existing example and determine how sealed key material can be persisted and loaded. Done means the example no longer writes the RSA private key in cleartext and demonstrates the requested encrypt-and-decrypt flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cryptography, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.