authenticexecution/rust-sgx-remote-attestation

Remote attestation framework for Fortanix EDP

rust-sgx-remote-attestation

Remote attestation framework for Fortanix EDP

Disclaimer

This project is highly experimental at the current stage, so I would advise aginst using it in production. I will keep updating the code and adding more instructions.

Dependencies

• Fortanix EDP
• Clang 3.8 or older for building rust-mbedtls

Note: If your system has a newer version of Clang installed, try pointing clang-sys to a different version of Clang by exporting these environment variables, including LD_LIBRARY_PATH, before building. For example,

export PATH=/real/path/to/clang/bin/:$PATH
export LLVM_CONFIG_PATH=/real/path/to/clang/bin/llvm-config
export LD_LIBRARY_PATH=/real/path/to/clang/lib

before building and running (see below).

How to Build and Run Example

1. Sign up for a Development Access account at https://api.portal.trustedservices.intel.com/EPID-attestation. Make sure that the Name Base Mode is Linkable Quote (this is all the SDK can support for now). Take note of "SPID", "Primary key", and "Secondary key".
2. Modify the following fields in settings.json using the information from the previous step:

• "spid": "<SPID>"
• "primary_subscription_key": "<Primary Key>"
• "secondary_subscription_key": "<Secondary key>"

3. Download IAS's root certificate from this link and save the cerficate file in directory ra-sp/examples/data/. Make sure the file name is "Intel_SGX_Attestation_RootCA.pem".
4. Run the script build.sh and run.sh consecutively from the main directory.

If there are no error messages on the screen, then the remote attestation has run successfully.

Customization

• settings.json

  • linkable: true for Linkable Quotes or false for Unlinkable Quotes. Only Linkable Quotes are currently supported.
  • random_nonce: true for using Quote nonce or false otherwise. Quote nonce is currently unsupported.
  • use_platform_service: true to use Platform Service Enclave (PSE) or false otherwise. PSE is currently unsupported.
  • spid: Service Provider ID to talk to IAS.
  • primary_subscription_key: subscription key to talk to IAS.
  • secondary_subscription_key: subscription key to talk to IAS.
  • quote_trust_options: list of quote status options to be accepted as successful remote attestation. If left empty, quote status must be "OK" to be considered successful. For all the options, check the API documentation and look for "isvEnclaveQuoteStatus".
  • sp_private_key_pem_path: path to SP's private key file in PEM format. This is used for authentication during key-exchange so it must be regenerated and kept secret.
  • ias_root_cert_pem_path: path to IAS root certificate for SP to verify IAS during attestation. This can be downloaded from this link.
  • sigstruct_path: path to enclave's SIGSTRUCT generated by the sgxs-sign command. This is provided by the vendor, i.e. the party who builds and signs enclave files, to SP for SP to verify enclave authenticity.

• sp_vkey.rs, sp-keys/public_key.pem and sp-keys/private_key.pem: SP's signing and verification key. This key pair is used to provide authentication for SP to the enclave during key-exchange, and therefore must be fresh for every SP. private_key.pem must be kept secret by SP. sp_vkey.rs containts the same key as in public_key.pem, but sp_vkey.rs must be embeded in the enclave file at compile time, i.e. it must not be read into the enclave from the file system at runtime, in order to prevent man-in-the-middle attacks.

• vendor-keys/private_key.pem: Vendor's signing key. This is used by software vendors to sign enclave files with the sgxs-sign command. This signing key must be regenerated.

TODO

• Update aesm_client to version 0.4 to support Quote nonce and Linkable Quotes. See this commit.
• Use the secondary subscription key if the primary one fails.
• Support PSE (this doesn't seem to be supported by the main library yet.)

rust-sgx-remote-attestation's Issues

Use different RNG for machines without `Rdrand`

rust-sgx-remote-attestation/sgx-crypto/Cargo.toml

Line 14 in d9abcda

mbedtls = { git = "https://github.com/gianlu33/rust-mbedtls.git", branch="psk", features = ["rdrand"] }

Rdrand is used when establishing the TLS-PSK channel, and it won't work on machines that do not support it. It is used when communicating with the Attestation Manager (it affects the CLI and the AM in native mode)

Replace IAS calls from v3 to v4

Dear Customer, We are announcing an extended EOL date for DEV Intel® Software Guard Extensions Attestation Service (IAS) API version 3.
IAS API version 3 was replaced by IAS API version 4 documented here. The DEV IAS API version 3 will be End Of Life'ed (EOL'ed) on February 16th, 2023. Please work on the migration plan to IAS API version 4 before the EOL date. If you have any questions please contact your Intel Support Engineer or send an email to [email protected] Thank You, Intel SGX Services Team

https://www.intel.com/content/dam/develop/public/us/en/documents/sgx-attestation-api-spec.pdf

Error in build rust-sgx-remote-attestation

Hi. When i execute a build.sh script, two errors are showed:

error[E0432]: unresolved import `sgx_crypto::tls_psk::server`
 --> examples/tls-enclave.rs:7:5
  |
7 | use sgx_crypto::tls_psk::server;
  |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^ no `server` in `tls_psk`

warning: unused import: `WriteBytesExt`
 --> examples/tls-enclave.rs:4:32
  |
4 | use byteorder::{NetworkEndian, WriteBytesExt};
  |                                ^^^^^^^^^^^^^
  |
  = note: `#[warn(unused_imports)]` on by default

warning: unused import: `std::io::Write`
 --> examples/tls-enclave.rs:8:5
  |
8 | use std::io::Write;
  |     ^^^^^^^^^^^^^^

For more information about this error, try `rustc --explain E0432`.


error[E0432]: unresolved import `sgx_crypto::tls_psk::client`
 --> examples/tls-sp.rs:4:5
  |
4 | use sgx_crypto::tls_psk::client;
  |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^ no `client` in `tls_psk`

warning: unused import: `ReadBytesExt`
 --> examples/tls-sp.rs:1:32
  |
1 | use byteorder::{NetworkEndian, ReadBytesExt};
  |                                ^^^^^^^^^^^^
  |
  = note: `#[warn(unused_imports)]` on by default

warning: unused import: `std::io::Read`
 --> examples/tls-sp.rs:5:5
  |
5 | use std::io::Read;
  |     ^^^^^^^^^^^^^

For more information about this error, try `rustc --explain E0432`.
warning: `ra-sp` (example "tls-sp") generated 2 warnings

These errors break the build process. I installed all README requirements, and I was trying to use rustc 1.70.0-nightly and rustc 1.58.0-nightly toolchains, but it occurs at same way.
I attached the full errors in files.

Thank you for attention.

build.sh.txt
build.sh_up.txt