intel / intel/confidential-computing.sgx
ECDSA key ID returned in GetSupportedAttKeyIDsResponse even when not supported
- Dominant language
- C++
- Stars
- 1.5k
- Forks
- 565
- PR merge metrics
- No merged PRs in 30d
Description
As per title, ECDSA key ID is returned even when not-supported.
This leads to to failure in init_quote_ex if it's used on unsupported hardware.
It works if it's used on supported hardware.
Should key be returned in this case? (operation is Get**Supported**AttKeyIDs...)
Failure when ECDSA key ID returned by GetSupportedAttKeyIDsResponse is used in InitQuoteRequest (on unsupported hardware):
```
[build_image /linux-sgx/psw/urts/loader.cpp:582] init_enclave failed
[load_qe ../qe_logic.cpp:633] Error, call sgx_create_enclave QE fail [load_qe], SGXError:4004.
[load_qe ../qe_logic.cpp:634] Failed to load enclave.
```
Where error 4004 is defined in: https://github.com/intel/linux-sgx/blob/master/common/inc/sgx_error.h
```
SGX_ERROR_SERVICE_INVALID_PRIVILEGE = SGX_MK_ERROR(0x4004), /* Enclave has no privilege to get launch token */
```
Operations are from protobuf: https://github.com/intel/linux-sgx/blob/master/psw/ae/aesm_service/source/core/ipc/messages.proto
Getting data is via: GetSupportedAttKeyIDsRequest / GetSupportedAttKeyIDsResponse.
This returns following data:
Structure: sgx_att_key_id_ext_t from: https://github.com/intel/linux-sgx/blob/master/common/inc/sgx_quote.h
Data - identical on both supported and unsupported hardware:
```
att_key_type: 0
spid: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
base: id 0
version: 0
mrsigner_length 32
mrsigner ([236, 21, 177, 7, 135, 210, 248, 70, 103, 206, 176, 181, 152, 255, 196, 74], [31, 28, 184, 15, 103, 10, 174, 93, 249, 232, 250, 159, 99, 118, 225, 248, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, $
prod_id 1
extended_prod_id [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
config_id ([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
family_id [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
algorithm_id 0
att_key_type: 1
spid: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
base: id 0
version: 0
mrsigner_length 32
mrsigner ([236, 21, 177, 7, 135, 210, 248, 70, 103, 206, 176, 181, 152, 255, 196, 74], [31, 28, 184, 15, 103, 10, 174, 93, 249, 232, 250, 159, 99, 118, 225, 248, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, $
prod_id 1
extended_prod_id [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
config_id ([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
family_id [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
algorithm_id 1
att_key_type: 0
spid: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
base: id 0
version: 0
mrsigner_length 32
mrsigner ([140, 79, 87, 117, 215, 150, 80, 62, 150, 19, 127, 119, 198, 138, 130, 154], [0, 86, 172, 141, 237, 112, 20, 11, 8, 27, 9, 68, 144, 197, 123, 255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
prod_id 1
extended_prod_id [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
config_id ([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
family_id [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
algorithm_id 2
```
Contributor guide
Assessment
This issue has not been assessed yet.