Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Integrations/ita] Add RA-TLS/SecretProv libs for Intel Trust Authority #59

Closed
wants to merge 1 commit into from

Conversation

AI-Memory
Copy link
Contributor

@AI-Memory AI-Memory commented Oct 10, 2023

This commit adds the sources, documentation and tests for libra_tls_verify_ita.so and libsecret_prov_verify_ita.so libraries, used for integration of Gramine with ITA.

This PR is largely based on the [Integration/azure] contributed by Dmitrii and a patch from Scott.


This change is Reviewable

…ty (ITA)

This commit adds the sources, documentation and tests for
`libra_tls_verify_ita.so` and `libsecret_prov_verify_ita.so` libraries,
used for integration of Gramine with ITA.

Signed-off-by: Scott Raynor <scott.raynor@intel.com>
Signed-off-by: Gordon King <gordon.king@intel.com>
@dimakuv
Copy link

dimakuv commented Jan 16, 2024

This PR is a bit hacky; many things are missing in this PR (like verifying the signature of the JWT token), many things are redundant (like parsing the public key of the cert, since it's not used in the PR).

The general idea of the PR is good. I will take over this work (ITA + Gramine integration), and will submit a PR similar to this one, but with all details flashed out. I will add @bigdata-memory as a co-author in the new PR. I hope it's fine with @bigdata-memory.

My analysis can be found in #73.

@dimakuv dimakuv closed this Jan 16, 2024
@dimakuv
Copy link

dimakuv commented Jan 17, 2024

A quick note.

The statement in this PR's README:

Note that the library does not use the following SGX-enclave-status environment variables:
RA_TLS_ALLOW_OUTDATED_TCB_INSECURE, RA_TLS_ALLOW_HW_CONFIG_NEEDED and RA_TLS_ALLOW_SW_HARDENING_NEEDED. This is because ITA will only generate a JWT for the SGX enclave if the enclave's TCB level matches the "TCB baseline" specified in the used ITA policy. In other words, ITA takes the responsibility away from the Gramine user and decides about the allowed security status of the SGX enclave based on its policy and not based on the aforementioned RA-TLS environment variables.

This statement is wrong. It was copied from MAA, where the statement was true. However, the ITA does not take the responsibility away from the user but actually reports the TCB level/status in the JWT field attester_tcb_status. In fact, there is a bunch of JWT fields, under the class "Attester claims", that must be verified by the end user, see here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants