Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PPID decryption tool #653

Merged
merged 19 commits into from
Nov 19, 2024
Merged

PPID decryption tool #653

merged 19 commits into from
Nov 19, 2024

Conversation

nshyrei
Copy link
Contributor

@nshyrei nshyrei commented Nov 7, 2024

This PR adds a tool to decrypt PPID (Platform Provisioning ID) from a PCE (Provisioning Certification) enclave. The idea is based on the existing tool from Intel - PCKRetrievalTool which retrieves platform-related info from PCE, but for PPID the tool encrypts the resulting data. To solve this we create 2 functions that create an RSA key-pair from constant parameters that we control and decrypt the resulting PPID.

Project modules:

  1. ID enclave. Contains functionality to create a pair of RSA keys for PCE enclave and PPID decryption function which is also a part of ID enclave. The functionality of this module is placed inside an enclave so that no adversary can pull RSA parameters or private key we use to decrypt the PPID;
  2. PCE enclave. Contains functionality to return PPID in encrypted form. Compiled C code for this enclave comes directly from Intel in the form of a prebuilt so file. To connect it to our code we have to provide an enclave definition file (.edl) and produce a
    C wrapper using sgx_edger8r tool;
  3. Main.c file in the root of the project. Entry point of the program, it connects 2 enclaves above together and prints the decrypted PPID to the console.

Additional info:

  1. More info about PPID, PCE and the whole process it fits into which is called DCAP can be found in the following link:
    https://docs.enclaive.cloud/confidential-cloud/technology-in-depth/intel-sgx/technology/concepts/dcap-attestation-framework
  2. PCKRetrievalTool link: https://github.com/intel/SGXDataCenterAttestationPrimitives/tree/main/tools/PCKRetrievalTool

@nshyrei nshyrei self-assigned this Nov 7, 2024
Copy link
Contributor

@raoulstrackx raoulstrackx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll continue reviewing when these comments have been addressed

intel-sgx/ppid-decryption-tool/Enclave/Makefile Outdated Show resolved Hide resolved
intel-sgx/ppid-decryption-tool/Enclave/Makefile Outdated Show resolved Hide resolved
intel-sgx/ppid-decryption-tool/Enclave/Makefile Outdated Show resolved Hide resolved
intel-sgx/ppid-decryption-tool/Enclave/id_enclave.c Outdated Show resolved Hide resolved
intel-sgx/ppid-decryption-tool/main.c Outdated Show resolved Hide resolved
@aditijannu
Copy link

Can you add a README file in your PR which includes some of the details mentioned in the PR description? It would be helpful for anyone who is new to this and provides a simple introduction to this tool.

- alphabetize
- added function comments
intel-sgx/ppid-retrieval-tool/Enclave/Makefile Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Enclave/ppid.edl Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Enclave/ppid.c Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Enclave/ppid.c Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Enclave/ppid.c Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Readme.md Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Readme.md Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Readme.md Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Readme.md Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/main.c Outdated Show resolved Hide resolved
Copy link
Collaborator

@Taowyoo Taowyoo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Finish reviewing pce & README. Will review the Enclave and main.c tomorrow.

intel-sgx/ppid-retrieval-tool/pce/pce_cert.h Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/pce/Makefile Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Readme.md Show resolved Hide resolved
@nshyrei nshyrei requested a review from Taowyoo November 13, 2024 20:34
intel-sgx/ppid-retrieval-tool/Enclave/ppid.c Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Enclave/ppid.config.xml Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Enclave/ppid.config.xml Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Enclave/ppid.c Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Enclave/ppid.c Outdated Show resolved Hide resolved
intel-sgx/ppid-retrieval-tool/Readme.md Outdated Show resolved Hide resolved
@nshyrei nshyrei added this pull request to the merge queue Nov 19, 2024
Merged via the queue into master with commit 6dafc6c Nov 19, 2024
1 check passed
@nshyrei nshyrei deleted the ns/RTE-107 branch November 19, 2024 10:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants