Hmac all the things

cosmwasm/enclaves/execute/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "secret-enclave"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["SCRT Labs <[email protected]>"]
 edition = "2018"
 description = "An enclave running wasmi, to be used by cosmwasm-sgx-vm"

cosmwasm/enclaves/shared/block-verifier/Cargo.toml

@@ -6,7 +6,7 @@ edition = "2018"
 [features]
 default = ["random"]
 test = ["base64"]
-random = []
+random = ["enclave_utils/random"]
 production = []
 verify-validator-whitelist = []
 

cosmwasm/enclaves/shared/block-verifier/src/verify/random.rs

@@ -1,34 +1,11 @@
 #![cfg(feature = "random")]
 
-use enclave_crypto::{sha_256, SIVEncryptable, KEY_MANAGER};
-use log::{debug, error, trace};
+use enclave_crypto::{SIVEncryptable, KEY_MANAGER};
+use log::{debug, error};
 use sgx_types::sgx_status_t;
 use tendermint::Hash;
+use enclave_utils::random::create_random_proof;
 
-pub fn create_proof(height: u64, random: &[u8], block_hash: &[u8]) -> [u8; 32] {
-    trace!(
-        "Height: {:?}\nRandom: {:?}\nApphash: {:?}",
-        height,
-        random,
-        block_hash
-    );
-    let irs = KEY_MANAGER.initial_randomness_seed.unwrap();
-
-    let height_bytes = height.to_be_bytes();
-    let irs_bytes = irs.get();
-
-    let data_len = height_bytes.len() + random.len() + block_hash.len() + irs_bytes.len();
-    let mut data = Vec::with_capacity(data_len);
-
-    data.extend_from_slice(&height_bytes);
-    data.extend_from_slice(random);
-    data.extend_from_slice(block_hash);
-    data.extend_from_slice(irs_bytes);
-
-    sha_256(data.as_slice())
-}
-
-#[cfg(feature = "random")]
 pub fn validate_encrypted_random(
     random_and_proof: &[u8],
     validator_set_hash: Hash,
@@ -42,7 +19,9 @@ pub fn validate_encrypted_random(
         .get(48..)
         .ok_or(sgx_status_t::SGX_ERROR_INVALID_PARAMETER)?;
 
-    let calculated_proof = create_proof(height, encrypted_random_slice, app_hash);
+
+    let irs = KEY_MANAGER.initial_randomness_seed.unwrap();
+    let calculated_proof = create_random_proof(&irs, height, encrypted_random_slice, app_hash);
 
     if calculated_proof != rand_proof {
         error!(

cosmwasm/enclaves/shared/contract-engine/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "enclave_contract_engine"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["Cashmaney <[email protected]>"]
 edition = "2018"
 

cosmwasm/enclaves/shared/cosmos-proto/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cosmos_proto"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["SCRT Labs <[email protected]>"]
 edition = "2018"
 

cosmwasm/enclaves/shared/cosmos-types/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "enclave_cosmos_types"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["Cashmaney <[email protected]>"]
 edition = "2018"
 

cosmwasm/enclaves/shared/cosmwasm-types/generic/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cw_types_generic"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["SCRT Labs <[email protected]>"]
 edition = "2018"
 

cosmwasm/enclaves/shared/cosmwasm-types/v0.10/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cw_types_v010"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["SCRT Labs <[email protected]>"]
 edition = "2018"
 

cosmwasm/enclaves/shared/cosmwasm-types/v1.0/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cw_types_v1"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["SCRT Labs <[email protected]>"]
 edition = "2018"
 

cosmwasm/enclaves/shared/crypto/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "enclave_crypto"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["SCRT Labs <[email protected]>"]
 edition = "2018"
 

cosmwasm/enclaves/shared/utils/Cargo.toml

@@ -1,11 +1,12 @@
 [package]
 name = "enclave_utils"
-version = "1.6.0"
+version = "1.11.0"
 authors = ["SCRT Labs <[email protected]>"]
 edition = "2018"
 
 [features]
 production = []
+random = []
 
 # This annotation is here to trick the IDE into showing us type information about this crate.
 # We always compile to the "sgx" target, so this will always be false.
@@ -28,3 +29,5 @@ serde = { git = "https://github.com/mesalock-linux/serde-sgx", features = [
   "derive"
 ] }
 serde_json = { git = "https://github.com/mesalock-linux/serde-json-sgx" }
+
+enclave_crypto = { path = "../crypto" }

cosmwasm/enclaves/shared/utils/src/lib.rs

@@ -17,3 +17,6 @@ mod results;
 pub mod storage;
 pub mod tx_bytes;
 pub mod validator_set;
+
+#[cfg(feature = "random")]
+pub mod random;

cosmwasm/enclaves/shared/utils/src/random.rs

@@ -0,0 +1,24 @@
+#![cfg(feature = "random")]
+
+use enclave_crypto::{AESKey, Hmac};
+use log::{trace};
+
+pub fn create_random_proof(key: &AESKey, height: u64, random: &[u8], block_hash: &[u8]) -> [u8; 32] {
+    trace!(
+        "Height: {:?}\nRandom: {:?}\nApphash: {:?}",
+        height,
+        random,
+        block_hash
+    );
+
+    let height_bytes = height.to_be_bytes();
+
+    let data_len = height_bytes.len() + random.len() + block_hash.len();
+    let mut data = Vec::with_capacity(data_len);
+
+    data.extend_from_slice(&height_bytes);
+    data.extend_from_slice(random);
+    data.extend_from_slice(block_hash);
+
+    key.sign_sha_256(&data)
+}

deployment/dockerfiles/Dockerfile

@@ -24,19 +24,7 @@ ENV PATH="/root/.cargo/bin:$PATH"
 # Set working directory for the build
 WORKDIR /go/src/github.com/enigmampc/SecretNetwork/
 
-COPY rust-toolchain rust-toolchain
-RUN rustup component add rust-src
-RUN cargo install xargo --version 0.3.25
-
-# Add submodules
-COPY third_party third_party
-
-# Add source files
-COPY go-cosmwasm go-cosmwasm/
-COPY cosmwasm cosmwasm/
-
 # ***************** COMPILE ENCLAVE ************** #
-
 FROM prepare-compile-enclave AS compile-enclave
 
 ARG BUILD_VERSION="v0.0.0"
@@ -51,42 +39,48 @@ ENV FEATURES=${FEATURES}
 ENV FEATURES_U=${FEATURES_U}
 ENV MITIGATION_CVE_2020_0551=${MITIGATION_CVE_2020_0551}
 
-COPY rust-toolchain rust-toolchain
-RUN rustup component add rust-src
-RUN cargo install xargo --version 0.3.25
-
 # Add submodules
 COPY third_party third_party
 
 # Add source files
 COPY go-cosmwasm go-cosmwasm/
 COPY cosmwasm cosmwasm/
 
+COPY rust-toolchain rust-toolchain
+RUN rustup component add rust-src
+RUN cargo install xargo --version 0.3.25
+
+
 WORKDIR /go/src/github.com/enigmampc/SecretNetwork/go-cosmwasm
 
 RUN . /opt/sgxsdk/environment && env \
     && MITIGATION_CVE_2020_0551=${MITIGATION_CVE_2020_0551} VERSION=${VERSION} FEATURES=${FEATURES} FEATURES_U=${FEATURES_U} SGX_MODE=${SGX_MODE} make build-rust
 
-ENTRYPOINT ["/bin/bash"]
-
 FROM prepare-compile-enclave AS compile-tendermint-enclave
 
+ARG BUILD_VERSION="v0.0.0"
 ARG SGX_MODE=SW
+ARG FEATURES
 ARG FEATURES_U
+ARG MITIGATION_CVE_2020_0551=LOAD
 
-ARG SGX_MODE=${SGX_MODE}
+ENV VERSION=${BUILD_VERSION}
+ENV SGX_MODE=${SGX_MODE}
+ENV FEATURES=${FEATURES}
 ENV FEATURES_U=${FEATURES_U}
+ENV MITIGATION_CVE_2020_0551=${MITIGATION_CVE_2020_0551}
 
-RUN git clone --branch v1.9.3 --depth 1 https://github.com/scrtlabs/tm-secret-enclave.git
+RUN git clone --branch main --depth 1 https://github.com/scrtlabs/tm-secret-enclave.git
 
 WORKDIR tm-secret-enclave
 
 RUN git submodule init
 RUN git submodule update --remote
 
 RUN rustup component add rust-src
+RUN cargo install xargo --version 0.3.25
 
-RUN . /opt/sgxsdk/environment && env && MITIGATION_CVE_2020_0551=${MITIGATION_CVE_2020_0551} SGX_MODE=${SGX_MODE} FEATURES_U="$(echo \"${FEATURES_U}\" | perl -pe 's/go-tests|debug-print//g')" make build
+RUN . /opt/sgxsdk/environment && env && LD_LIBRARY_PATH=/opt/sgxsdk/lib64 FEATURES=${FEATURES} MITIGATION_CVE_2020_0551=${MITIGATION_CVE_2020_0551} SGX_MODE=${SGX_MODE} FEATURES_U="$(echo \"${FEATURES_U}\" | perl -pe 's/go-tests|debug-print//g')" make build
 
 # ***************** COMPILE SECRETD ************** #
 FROM $SCRT_BASE_IMAGE_ENCLAVE AS compile-secretd
@@ -137,7 +131,6 @@ RUN mkdir -p /go/src/github.com/enigmampc/SecretNetwork/go-cosmwasm/target/relea
 
 COPY --from=compile-enclave /go/src/github.com/enigmampc/SecretNetwork/go-cosmwasm/target/release/libgo_cosmwasm.so /go/src/github.com/enigmampc/SecretNetwork/go-cosmwasm/target/release/libgo_cosmwasm.so
 COPY --from=compile-enclave /go/src/github.com/enigmampc/SecretNetwork/go-cosmwasm/librust_cosmwasm_enclave.signed.so /go/src/github.com/enigmampc/SecretNetwork/go-cosmwasm/librust_cosmwasm_enclave.signed.so
-# COPY --from=compile-enclave /go/src/github.com/enigmampc/SecretNetwork/go-cosmwasm/librust_cosmwasm_query_enclave.signed.so /go/src/github.com/enigmampc/SecretNetwork/go-cosmwasm/librust_cosmwasm_query_enclave.signed.so
 
 RUN mkdir -p /go/src/github.com/enigmampc/SecretNetwork/ias_keys/develop
 RUN mkdir -p /go/src/github.com/enigmampc/SecretNetwork/ias_keys/sw_dummy
@@ -188,7 +181,6 @@ ENV SCRT_ENCLAVE_DIR=/usr/lib/
 # workaround because paths seem kind of messed up
 RUN ln -s /opt/sgxsdk/lib64/libsgx_urts_sim.so /usr/lib/x86_64-linux-gnu/libsgx_urts_sim.so
 RUN ln -s /opt/sgxsdk/lib64/libsgx_uae_service_sim.so /usr/lib/x86_64-linux-gnu/libsgx_uae_service_sim.so
-
 # Install ca-certificates
 WORKDIR /root
 
@@ -211,6 +203,7 @@ RUN chmod +x bootstrap_init.sh
 RUN chmod +x startup.sh
 RUN chmod +x node_init.sh
 
+
 RUN secretd completion > /root/secretd_completion
 
 # RUN echo "SECRET_NODE_TYPE=${SECRET_NODE_TYPE}" >> ~/.bashrc