107 lines
3.5 KiB
Markdown
107 lines
3.5 KiB
Markdown
# Occlum SGX Remote Attestation integrated in TLS connection
|
|
|
|
The MRSIGNER of the `example/signing_key.pem` is hardcoded in the enclave code:
|
|
|
|
```
|
|
83E8A0C3ED045D9747ADE06C3BFC70FCA661A4A65FF79A800223621162A88B76
|
|
```
|
|
|
|
You can generate your own signing key. Just use the following command:
|
|
|
|
```
|
|
openssl genrsa -3 -out signing_key.pem 3072
|
|
```
|
|
|
|
To get the MRSIGNER of the key, compile [this project](https://github.com/intel/sgx-ra-sample)
|
|
and use the following command:
|
|
|
|
```
|
|
./mrsigner signing_key.pem
|
|
# For the example/signing_key.pem the output is:
|
|
6871A831CED408CD99F0ED31587CC2B5C728C99D4A0A1ADF2F0C5574EBBB00DC
|
|
# FIXME: Which is different from the real MRSIGNER by Occlum:
|
|
83E8A0C3ED045D9747ADE06C3BFC70FCA661A4A65FF79A800223621162A88B76
|
|
```
|
|
|
|
## Docker Occlum runtime
|
|
|
|
To run the project in Docker, you need to install the docker first.
|
|
On Ubuntu, you can use the following commands:
|
|
|
|
```bash
|
|
# Add docker official GPG key
|
|
sudo apt update
|
|
sudo apt install ca-certificates curl
|
|
sudo install -m 0755 -d /etc/apt/keyrings
|
|
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
|
|
sudo chmod a+r /etc/apt/keyrings/docker.asc
|
|
|
|
# Add docker repository to apt sources
|
|
echo \
|
|
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
|
|
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
|
|
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
|
|
sudo apt update
|
|
|
|
# Install docker packages
|
|
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
|
|
|
# Add your user to the docker group
|
|
sudo groupadd docker
|
|
sudo usermod -aG docker $USER
|
|
newgrp docker
|
|
```
|
|
|
|
Next run the occlum image in the docker environment:
|
|
|
|
```bash
|
|
docker run --rm -it --device /dev/sgx/enclave --device /dev/sgx/provision -v /path/to/occlum-ratls:/root/occlum-ratls occlum/occlum:latest-ubuntu20.04
|
|
|
|
# Inside the docker container do env preparation
|
|
rustup install stable-x86_64-unknown-linux-gnu
|
|
rustup default stable
|
|
rustup target add x86_64-unknown-linux-musl
|
|
# edit /etc/sgx_default_qcnl.conf, so that the PCCS URL is set correctly
|
|
# "pccs_url": "https://api.trustedservices.intel.com/sgx/certification/v4/"
|
|
|
|
cd /root/occlum-ratls
|
|
./build_server.sh grpcs --run
|
|
|
|
# In another terminal exec /bin/bash into the same container
|
|
cd /root/occlum-ratls
|
|
./build_client.sh grpcs --run
|
|
```
|
|
|
|
## Running Examples
|
|
|
|
Before running make sure you have installed the Occlum and the SGX driver.
|
|
You should also have the Occlum Rust toolchain installed to get `occlum-cargo`.
|
|
To test the project just run client and server scripts in different terminals:
|
|
|
|
```
|
|
|
|
./build_server.sh grpcs --run
|
|
./build_client.sh grpcs --run
|
|
|
|
```
|
|
|
|
## Mutual RATLS examples
|
|
|
|
Examples show how to use the mRATLS (Mutual Remote Attestation TLS) in different situations:
|
|
|
|
* The first example shows how to create mRATLS HTTPS server and client
|
|
* The second example shows how to create mRATLS GRPCs server and client
|
|
|
|
Both the server and the client must be running inside the enclave.
|
|
So during the remote attestation peers, acquire their RA certificates.
|
|
And during the TLS handshake, they verify each other's RA certificates.
|
|
The config allows to whitelist MRENCLAVE, MRSIGNER, PRODID, SVN of the peer.
|
|
|
|
## RATLS examples
|
|
|
|
Example shows how to create RATLS HTTPS server and client.
|
|
The server must be running inside the enclave.
|
|
The client can be running anywhere.
|
|
The server config allows to whitelist the public ec25519 key of the client.
|
|
The client config allows to whitelist MRENCLAVE, MRSIGNER, PRODID, SVN of the server.
|