apache / apache/teaclave-sgx-sdk
example request: static-data-distribution with sealed rsa key
- Dominant language
- Rust
- Stars
- 1.2k
- Forks
- 268
- PR merge metrics
- No merged PRs in 30d
Description
I've been playing around with sealeddata and static-data-distribution. The latter is a very interesting example but quite meaningless because the rsa key is written to file in cleartext. I've tried to combine this with sealeddata the following way, also solving trusted provisioning:
app calls generate_keys() enclave function, which:
1. generates rsa keypair
2. seals keypair
3. writes sealed keypair to file
4. returns pubkey
the app can then
1. encrypt some cleartext with the enclave pubkey
2. send the ciphertext to enclave which reads the rsa keypair from file and decrypts and prints the ciphertext
IMO this would be meaningful and close to a real use case.
However, I'm struggling with various approaches :
**try1**
```
//enclave/src/lib.rs
...
let rsa_keypair = Rsa3072KeyPair::new().unwrap();
let rsa_key_json = serde_json::to_string(&rsa_keypair).unwrap();
let result = SgxSealedData::::seal_data(&aad, &rsa_key_json);
let _sealed_rsa_keypair = match result {
Ok(x) => x,
Err(ret) => { return ret; },
};
let sealed_rsa_key_json = serde_json::to_string(&_sealed_rsa_keypair).unwrap();
...
```
sgx_tseal::SgXSealedData doesn't implement traits Serialize, Deserialize, so I can't use json
**try2**
another approach is to generate rsa keypair deterministically from a seed, but your sgx_crypto_helper functions do not allow this (would be a nice feature ;-).
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in the static-data-distribution example and the enclave/src/lib.rs code shown in the issue, then read the sealeddata APIs and SgxSealedData limitations. Compare the proposed generate_keys flow with the existing example and determine how sealed key material can be persisted and loaded. Done means the example no longer writes the RSA private key in cleartext and demonstrates the requested encrypt-and-decrypt flow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100