intel / intel/confidential-computing.sgx.sdk
request to support additional check for the mrsigner, proid, svnid etc in the ttls library.
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
The lib of https://github.com/intel/linux-sgx/tree/master/sdk/ttls,it will embed the quote as an extension into the TLS X.509 certification, currently, it only verify the quote's signature, however, we suppose that in some case scenarios it may need to check some additional information such as mrsigner, proid, svnid etc to assure the peer enclave's identity.
So, in https://github.com/intel/linux-sgx/blob/master/sdk/ttls/ttls.cpp#L175, suggest providing a way to let the user add more additional checks based on the specific request.
Contributor guide
Research direction
Start at sdk/ttls/ttls.cpp around line 175, where the TLS X.509 certificate's embedded quote is verified. Trace the existing quote-signature verification and determine how callers could request additional checks such as mrsigner, proid, and svnid. Done means the ttls library provides a documented way for users to apply these identity checks for their specific scenarios.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100