Running in nitro got stuck when calling `verify_signature`

[awslabs]

Running in nitro got stuck when calling `verify_signature`

[petreeftime]

I'll take a look. The code is supposed to work as it did previously, with some minor adjustments.

[petreeftime]

I was able to reproduce the issue. I don't think it's strictly related to aws-nitro-enclaves-cose, but rather to either openssl itself or the openssl crate. openssl is trying to initialize it's entropy pool, even if it does not require it, and is getting stuck because of it. I've tried using this with our latest artifacts (including PR aws/aws-nitro-enclaves-sdk-bootstrap#9) and it finishes without issues. I'll look into a mitigation for Rust until these artifacts are ready to be published, to help seed the random pool directly.

[raindust]

I was able to reproduce the issue. I don't think it's strictly related to aws-nitro-enclaves-cose, but rather to either openssl itself or the openssl crate. openssl is trying to initialize it's entropy pool, even if it does not require it, and is getting stuck because of it. I've tried using this with our latest artifacts (including PR aws/aws-nitro-enclaves-sdk-bootstrap#9) and it finishes without issues. I'll look into a mitigation for Rust until these artifacts are ready to be published, to help seed the random pool directly.

Thanks for your great job, I'm looking forward to seeing this can be done

[petreeftime]

This bit of code seeds the random pool with entropy from NSM:

use nsm_io::{Request, Response};
use std::convert::TryInto;
use std::fs::OpenOptions;
use std::io::Write;
use std::os::unix::io::AsRawFd;

const RND_IOC_MAGIC: u8 = b'R';
const RND_IOC_ADDTOENTCNT: u8 = 0x01;
nix::ioctl_write_ptr!(add_entropy_count, RND_IOC_MAGIC, RND_IOC_ADDTOENTCNT, libc::c_int);

fn seed_entropy(nsm_fd: i32, target: usize) {
    let mut written = 0;
    let mut file = OpenOptions::new().write(true).open("/dev/random").unwrap();
    while written < target {
        let request = Request::GetRandom;
        let response = nsm_driver::nsm_process_request(nsm_fd, request);
        let rand_bytes = match response {
            Response::GetRandom { random } => random,
            response => panic!("unexpected response {:?}", response),
        };
        file.write_all(rand_bytes.as_slice()).unwrap();
        written = written.saturating_add(rand_bytes.len());
    }
    unsafe {
        let bits: libc::c_int = written.try_into().unwrap();
        add_entropy_count(file.as_raw_fd().into(), &bits as *const libc::c_int).unwrap();
    }
}

fn main() {
    let nsm_fd = nsm_driver::nsm_init();
    seed_entropy(nsm_fd, 1024);
    nsm_driver::nsm_exit(nsm_fd);
}

[petreeftime]

Let me know if this works for you, and if not, please re-open the issue.