How to prove that certain data is calculated(or generated) inside Enclave(Intel SGX)?

问题

I tried to generate asymmetric key pair inside enclave(private key might be invisible to outside), and

then expose public key with evidence(i guess quote or remote attestation related things).

I got how remote attestation goes but, i cannot come up with applying remote attestation to verifying enclave-generated data.

Is this possible scenario with Intel SGX?

回答1:

You can prove the origin of the public key by placing it in the report_data field of a Quote generated during report attestation.

_quote_t.report_data can be used to attest arbitrary data:

The 64 byte data buffer is free form data and you can supply any information in that buffer that you would like to have identified as being in the possession and protection envelope of the enclave when the report/quote was generated. You can thus use this buffer to convey whatever information you would like to a verifying party. (Source)

The report_data field can be found by tracking the following structures:

sgx_key_exchange.h

typedef struct _ra_msg3_t {
    sgx_mac_t                mac
    sgx_ec256_public_t       g_a;
    sgx_ps_sec_prop_desc_t   ps_sec_prop;
    uint8_t                  quote[];    // <- Here!
} sgx_ra_msg3_t;

sgx_quote.h

typedef struct _quote_t
{
    uint16_t            version;        
    uint16_t            sign_type;      
    sgx_epid_group_id_t epid_group_id;  
    sgx_isv_svn_t       qe_svn;         
    sgx_isv_svn_t       pce_svn;        
    uint32_t            xeid;           
    sgx_basename_t      basename;       
    sgx_report_body_t   report_body;  // <- Here!  
    uint32_t            signature_len;
    uint8_t             signature[];    
} sgx_quote_t;

The Quote is part of the Msg3 (client-to-server) of remote attestation protocol. You can review the details of Msg3 creation in this official Code Sample and in the intel/sgx-ra-sample RA example.

In the latter, you can find out how the report is generated using sgx_create_report:

sgx_status_t get_report(sgx_report_t *report, sgx_target_info_t *target_info)
{
#ifdef SGX_HW_SIM
    return sgx_create_report(NULL, NULL, report);
#else
    return sgx_create_report(target_info, NULL, report);
#endif
}

In both cases, second argument sgx_report_data_t *report_data is NULL and can be replaced by pointer to arbitrary input. This is where you want to put your public key or any other data.

来源：https://stackoverflow.com/questions/59105622/how-to-prove-that-certain-data-is-calculatedor-generated-inside-enclaveintel

标签

sgx

enclave