-
Notifications
You must be signed in to change notification settings - Fork 99
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PPID decryption tool #653
PPID decryption tool #653
Conversation
- added root makefile
- added pce enclave make file
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll continue reviewing when these comments have been addressed
Can you add a README file in your PR which includes some of the details mentioned in the PR description? It would be helpful for anyone who is new to this and provides a simple introduction to this tool. |
- alphabetize - added function comments
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Finish reviewing pce & README. Will review the Enclave and main.c tomorrow.
This PR adds a tool to decrypt
PPID
(Platform Provisioning ID) from aPCE
(Provisioning Certification) enclave. The idea is based on the existing tool from Intel -PCKRetrievalTool
which retrieves platform-related info fromPCE
, but forPPID
the tool encrypts the resulting data. To solve this we create 2 functions that create anRSA
key-pair from constant parameters that we control and decrypt the resultingPPID
.Project modules:
ID
enclave. Contains functionality to create a pair of RSA keys forPCE
enclave andPPID
decryption function which is also a part ofID
enclave. The functionality of this module is placed inside an enclave so that no adversary can pull RSA parameters or private key we use to decrypt thePPID
;PCE
enclave. Contains functionality to returnPPID
in encrypted form. Compiled C code for this enclave comes directly from Intel in the form of a prebuiltso
file. To connect it to our code we have to provide an enclave definition file (.edl
) and produce aC wrapper using
sgx_edger8r
tool;Main.c
file in the root of the project. Entry point of the program, it connects 2 enclaves above together and prints the decryptedPPID
to the console.Additional info:
PPID
,PCE
and the whole process it fits into which is calledDCAP
can be found in the following link:https://docs.enclaive.cloud/confidential-cloud/technology-in-depth/intel-sgx/technology/concepts/dcap-attestation-framework
PCKRetrievalTool
link: https://github.com/intel/SGXDataCenterAttestationPrimitives/tree/main/tools/PCKRetrievalTool