Add support for signed output from runtime#256
Merged
bendecoste merged 12 commits intomainfrom Mar 27, 2023
Merged
Conversation
this previously always output plain output
justin1121
reviewed
Mar 27, 2023
| } | ||
| log.Debugf("< Received Function Results.") | ||
| resData.DecodedAttestationDocument = attestDoc.decoded | ||
| resData.RawAttestationDocument = attestDoc.raw |
Contributor
There was a problem hiding this comment.
Is there a specific reason we're returning the raw attestation document?
justin1121
previously approved these changes
Mar 27, 2023
gavinuhma
reviewed
Mar 27, 2023
sdk/run.go
Outdated
| return nil, err | ||
| } | ||
|
|
||
| if err := rsa.VerifyPSS(publicKey, crypto.SHA256, c.Sum(nil), resData.SignedResults, nil); err != nil { |
Member
There was a problem hiding this comment.
PCRs use Sha384, we could use that as well to be consistent. Not a big deal though
kitschysynq
previously approved these changes
Mar 27, 2023
kitschysynq
approved these changes
Mar 27, 2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runtime now returns a PSS-signed bundle of checksums with a run result. The bundle looks like
Where the input is the input into the function, the output is the result from the function, and the function is the function itself. All of these are hashed with sha-256.
That checksum bundle (as json) is then hashed with sha-256 and pss-signed using a private key that is generated by the enclave for the purpose of signing. The public key is returned in the user data field of the attestation document as
signature_verification_public_key(it is not the key in the public key field of the attestation document).This verification will automatically happen when a function is ran now.
You can also use
-o jsonto see all of this information. E.g.,The feature could be considered "incubating". The flow still needs to be audited by a 3rd party and is subject to change as we play with it.