intel / intel/confidential-computing.sgx.sdk

request to support additional check for the mrsigner, proid, svnid etc in the ttls library.

Open
#126 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C++
Stars
2
Forks
3
PR merge metrics
No merged PRs in 30d

Description

The lib of https://github.com/intel/linux-sgx/tree/master/sdk/ttls,it will embed the quote as an extension into the TLS X.509 certification, currently, it only verify the quote's signature, however, we suppose that in some case scenarios it may need to check some additional information such as mrsigner, proid, svnid etc to assure the peer enclave's identity.

So, in https://github.com/intel/linux-sgx/blob/master/sdk/ttls/ttls.cpp#L175, suggest providing a way to let the user add more additional checks based on the specific request.

Contributor guide

Open the contributing guide

Research direction

Start at sdk/ttls/ttls.cpp around line 175, where the TLS X.509 certificate's embedded quote is verified. Trace the existing quote-signature verification and determine how callers could request additional checks such as mrsigner, proid, and svnid. Done means the ttls library provides a documented way for users to apply these identity checks for their specific scenarios.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.