sgxs-sign support offline signing #327
Conversation
Supports an offline signing process for the creation of the sigstruct
Also maintain backwards compatibility
|
Thanks for the PR! I'd certainly like to support signing with key that's not just stored on disk. However, I'm not sure if the proposed flow is the right UX. As mentioned in #184 (comment), I'm thinking more along the lines of different implementations of sgxs::crypto::SgxRsaOps, for example PKCS#11 or KMIP. Would that work for you? |
|
@jethrogb Thanks for the quick response! Completely understand this isn't ideal UX. There was a practical reason on my side, I didn't want to install too many things on an airgapped device. That being said, I think you're right that ultimately that's a nicer UX. Would you be open to supporting both experiences? |
This is exactly what I have done for multiple types of signing. It worked out nicely. |
429: sgxs crate changes to enable offline signing r=[Pagten] a=arai-fortanix This change adds new interfaces to the `sgxs` crate to make it possible to sign enclaves separately from creating the sigstructs. This is useful, for example, for performing signing via an HSM. The first two commits in this sequence come from this pull request from ravenac95: #327. I did not include the changes to the command-line sgx-sign tool from that pull request. I think we can have a separate discussion about whether we want to support that model. The library changes should be less controversial. I also included a change to expose the hash bytes from an EnclaveHash object. That comes from #341 from trevor-crypto. This change should be backward-compatible with old code using this crate. New code that wants to use the new `cat_sign()` method and is using a custom key implementation will need to provide the new `SgxRsaPubOps()` trait for calculating the Q1 and Q2 values from a signature, instead of doing this during signing. Co-authored-by: Reuven V. Gonzales <reuven@oasislabs.com> Co-authored-by: Daniel Arai <daniel@fortanix.com>
This PR adds support to
sgxs-signfor an offline signing process for enclaves. This should allow for things like HSMs to be part of the signing ceremony for enclaves created with this sdk.Notes:
sgxs-signnow has subcommands that mirror those available with intel's sgx sdk. These subcommands are:sign- This is the same as the original sgxs-sign behaviorgendata- Generates a hash of the sigstruct data to be signedcatsig- Adds a signature to a sigstructverifyvalidates a SIGSTRUCT against a given public key (the enclave hash is not validated but is output to stdout).