The confidential-computing-modules from layerxcom

Fix apply function of StfWrapper

Related: #33

Apply function should be executed with arbitrary state input and output parameters.

https://github.com/LayerXcom/anonify/blob/00bef4a5462487c523bf3bb3819e03dfd47c8831/core/enclave/src/state.rs#L293-L318

Implement async RPC-handler

Currently, RPC clients connect to blockchain nodes synchronously. Support async way.

Certificate logs

X-IASReport-Signing-Certificate:

-----BEGIN%20CERTIFICATE-----%0AMIIEoTCCAwmgAwIBAgIJANEHdl0yo7CWMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNV%0ABAYTAlVTMQswCQYDVQQIDAJDQTEUMBIGA1UEBwwLU2FudGEgQ2xhcmExGjAYBgNV%0ABAoMEUludGVsIENvcnBvcmF0aW9uMTAwLgYDVQQDDCdJbnRlbCBTR1ggQXR0ZXN0%0AYXRpb24gUmVwb3J0IFNpZ25pbmcgQ0EwHhcNMTYxMTIyMDkzNjU4WhcNMjYxMTIw%0AMDkzNjU4WjB7MQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFDASBgNVBAcMC1Nh%0AbnRhIENsYXJhMRowGAYDVQQKDBFJbnRlbCBDb3Jwb3JhdGlvbjEtMCsGA1UEAwwk%0ASW50ZWwgU0dYIEF0dGVzdGF0aW9uIFJlcG9ydCBTaWduaW5nMIIBIjANBgkqhkiG%0A9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqXot4OZuphR8nudFrAFiaGxxkgma/Es/BA%2Bt%0AbeCTUR106AL1ENcWA4FX3K%2BE9BBL0/7X5rj5nIgX/R/1ubhkKWw9gfqPG3KeAtId%0Acv/uTO1yXv50vqaPvE1CRChvzdS/ZEBqQ5oVvLTPZ3VEicQjlytKgN9cLnxbwtuv%0ALUK7eyRPfJW/ksddOzP8VBBniolYnRCD2jrMRZ8nBM2ZWYwnXnwYeOAHV%2BW9tOhA%0AImwRwKF/95yAsVwd21ryHMJBcGH70qLagZ7Ttyt%2B%2BqO/6%2BKAXJuKwZqjRlEtSEz8%0AgZQeFfVYgcwSfo96oSMAzVr7V0L6HSDLRnpb6xxmbPdqNol4tQIDAQABo4GkMIGh%0AMB8GA1UdIwQYMBaAFHhDe3amfrzQr35CN%2Bs1fDuHAVE8MA4GA1UdDwEB/wQEAwIG%0AwDAMBgNVHRMBAf8EAjAAMGAGA1UdHwRZMFcwVaBToFGGT2h0dHA6Ly90cnVzdGVk%0Ac2VydmljZXMuaW50ZWwuY29tL2NvbnRlbnQvQ1JML1NHWC9BdHRlc3RhdGlvblJl%0AcG9ydFNpZ25pbmdDQS5jcmwwDQYJKoZIhvcNAQELBQADggGBAGcIthtcK9IVRz4r%0ARq%2BZKE%2B7k50/OxUsmW8aavOzKb0iCx07YQ9rzi5nU73tME2yGRLzhSViFs/LpFa9%0AlpQL6JL1aQwmDR74TxYGBAIi5f4I5TJoCCEqRHz91kpG6Uvyn2tLmnIdJbPE4vYv%0AWLrtXXfFBSSPD4Afn7%2B3/XUggAlc7oCTizOfbbtOFlYA4g5KcYgS1J2ZAeMQqbUd%0AZseZCcaZZZn65tdqee8UXZlDvx0%2BNdO0LR%2B5pFy%2BjuM0wWbu59MvzcmTXbjsi7HY%0A6zd53Yq5K244fwFHRQ8eOB0IWB%2B4PfM7FeAApZvlfqlKOlLcZL2uyVmzRkyR5yW7%0A2uo9mehX44CiPJ2fse9Y6eQtcfEhMPkmHXI01sN%2BKwPbpA39%2BxOsStjhP9N1Y1a2%0AtQAVo%2ByVgLgV2Hws73Fc0o3wC78qPEA%2Bv2aRs/Be3ZFDgDyghc/1fgU%2B7C%2BP6kbq%0Ad4poyb6IW8KCJbxfMJvkordNOgOUUxndPHEi/tb/U7uLjLOgPA%3D%3D%0A-----END%20CERTIFICATE-----%0A-----BEGIN%20CERTIFICATE-----%0AMIIFSzCCA7OgAwIBAgIJANEHdl0yo7CUMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNV%0ABAYTAlVTMQswCQYDVQQIDAJDQTEUMBIGA1UEBwwLU2FudGEgQ2xhcmExGjAYBgNV%0ABAoMEUludGVsIENvcnBvcmF0aW9uMTAwLgYDVQQDDCdJbnRlbCBTR1ggQXR0ZXN0%0AYXRpb24gUmVwb3J0IFNpZ25pbmcgQ0EwIBcNMTYxMTE0MTUzNzMxWhgPMjA0OTEy%0AMzEyMzU5NTlaMH4xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEUMBIGA1UEBwwL%0AU2FudGEgQ2xhcmExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMTAwLgYDVQQD%0ADCdJbnRlbCBTR1ggQXR0ZXN0YXRpb24gUmVwb3J0IFNpZ25pbmcgQ0EwggGiMA0G%0ACSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCfPGR%2BtXc8u1EtJzLA10Feu1Wg%2Bp7e%0ALmSRmeaCHbkQ1TF3Nwl3RmpqXkeGzNLd69QUnWovYyVSndEMyYc3sHecGgfinEeh%0ArgBJSEdsSJ9FpaFdesjsxqzGRa20PYdnnfWcCTvFoulpbFR4VBuXnnVLVzkUvlXT%0AL/TAnd8nIZk0zZkFJ7P5LtePvykkar7LcSQO85wtcQe0R1Raf/sQ6wYKaKmFgCGe%0ANpEJUmg4ktal4qgIAxk%2BQHUxQE42sxViN5mqglB0QJdUot/o9a/V/mMeH8KvOAiQ%0AbyinkNndn%2BBgk5sSV5DFgF0DffVqmVMblt5p3jPtImzBIH0QQrXJq39AT8cRwP5H%0AafuVeLHcDsRp6hol4P%2BZFIhu8mmbI1u0hH3W/0C2BuYXB5PC%2B5izFFh/nP0lc2Lf%0A6rELO9LZdnOhpL1ExFOq9H/B8tPQ84T3Sgb4nAifDabNt/zu6MmCGo5U8lwEFtGM%0ARoOaX4AS%2B909x00lYnmtwsDVWv9vBiJCXRsCAwEAAaOByTCBxjBgBgNVHR8EWTBX%0AMFWgU6BRhk9odHRwOi8vdHJ1c3RlZHNlcnZpY2VzLmludGVsLmNvbS9jb250ZW50%0AL0NSTC9TR1gvQXR0ZXN0YXRpb25SZXBvcnRTaWduaW5nQ0EuY3JsMB0GA1UdDgQW%0ABBR4Q3t2pn680K9%2BQjfrNXw7hwFRPDAfBgNVHSMEGDAWgBR4Q3t2pn680K9%2BQjfr%0ANXw7hwFRPDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADANBgkq%0AhkiG9w0BAQsFAAOCAYEAeF8tYMXICvQqeXYQITkV2oLJsp6J4JAqJabHWxYJHGir%0AIEqucRiJSSx%2BHjIJEUVaj8E0QjEud6Y5lNmXlcjqRXaCPOqK0eGRz6hi%2BripMtPZ%0AsFNaBwLQVV905SDjAzDzNIDnrcnXyB4gcDFCvwDFKKgLRjOB/WAqgscDUoGq5ZVi%0AzLUzTqiQPmULAQaB9c6Oti6snEFJiCQ67JLyW/E83/frzCmO5Ru6WjU4tmsmy8Ra%0AUd4APK0wZTGtfPXU7w%2BIBdG5Ez0kE1qzxGQaL4gINJ1zMyleDnbuS8UicjJijvqA%0A152Sq049ESDz%2B1rRGc2NVEqh1KaGXmtXvqxXcTB%2BLjy5Bw2ke0v8iGngFBPqCTVB%0A3op5KBG3RjbF6RRSzwzuWfL7QErNC8WEy5yDVARzTA5%2BxmBc388v9Dm21HGfcC8O%0ADD%2BgT9sSpssq0ascmvH49MOgjt1yoysLtdCtJW/9FZpoOypaHx0R%2BmJTLwPXVMrv%0ADaVzWh5aiEx%2BidkSGMnX%0A-----END%20CERTIFICATE-----%0A

Decoded cert:

Use anyhow and thiserror with error-handling operations

Implement macros for customizable value of enclave KVS

It allows us to implement arbitrary value of enclave KVS in runtime interface.

Research on using occlum instead of Rust SGX SDK

https://github.com/occlum/occlum

Consider a nonce to verify signature in enclave

Currently, a random nonce is generated by the client-side per each state transition call. It would be more suitable to be generated by the host server-side and then send a request to the client-side. We can also consider that the signature will not leak outside because the signature is always sent via TLS connections. so we don't have to consider replay-attacks.
https://github.com/LayerXcom/anonify/blob/b530705f53d2d8981f94f54c1c78315726ff2ad3/core/host/src/ecalls.rs#L95

Support TLS to Drone CI connections

Implement unlock features

Implement unlock features to specific states for efficiency.

Consider alternative ECDSA lib

https://github.com/RustCrypto/signatures which is pure rust and compatible with no-std env.

Change serde_bytes to bincode

Currently. serde_bytes is used to serialize/deserialize to bytes.
https://github.com/LayerXcom/anonify/blob/35a0ed3e6413d1d8fbaecf1fc734796e882618aa/wallet/src/lib.rs#L30-L35

https://github.com/servo/bincode

Define function signature to be called in enclave

Currently, developers have to fix the interface of state transition function which is implemented by their own. For more generalization, a provided client SDK can specify the calling function and executed it in the enclave.
The basic way is defining the type and trait implemented the functions so that search the expected function signature.
https://github.com/LayerXcom/anonify/blob/00bef4a5462487c523bf3bb3819e03dfd47c8831/core/common/src/stf.rs#L78-L86

Can traits be implemented in FFI functions?

Currently, actual types are implemented for State traits as StateType because traits cannot be implemented in FFI functions such as ecalls. However, it costs additional overhead by byte castings.

Define RawAccessRight type

Curerntly decomposed access right components because of un-matched signature value.
https://github.com/LayerXcom/anonify/blob/06c84f0b91c8b78f18896abadce18e966c5b56fc/core/enclave/src/bridges/ecalls.rs#L61-L63

Define generics to no_mangle functions

https://github.com/LayerXcom/anonify/blob/ace54e56d37e11313d1dfbf6381665865f8e7ced/core/enclave/src/bridges/ecalls.rs#L80

Get compatible with actix-web and sgx-sdk

The Enclave is initialized at the time of starting actix-web-based server as a global shared state, but it'll be different context when it handles requests.

thread 'actix-rt:worker:0' panicked at 'Failed to deploy contract.: HostError { inner: 

SGX Ecall Failed function: ecall_contract_deploy, status: SGX_ERROR_INVALID_ENCLAVE_ID }', src/libcore/result.rs:1084:5

Create REPORT inside an enclave

Currently, REPORT struct is created in the untrusted part because its data doesn't need to be sent with sockets via o_call and o_call instructions for getting REPORT data, but REPORT should be created inside an enclave to be included the enclave measurement.

Change key format of enclave KVS

The key should be like Hash(UserAddress, MemId) so that all key and value are corresponding to one-to-one. This structure ensures encrypted state to be specialized for each memid.

Use rust-secp256k1 inside enclave

From a security perspective, use rust-secp256k1 inside enclave intstead of libsecp256k1 which is pure-rust implementation though.

Support DCAP

ref:

Update cmake to support DCAP attestation service

Consider data conversion architecture between ledeger and anonify

Consider how to convert data stored in a ledger into enclaves and vice versa.

Allow contract address to set prefix "0x"

Currently, If prefix "0x" set to contract address argument, it causes an error.
https://github.com/LayerXcom/anonify/blob/3fafdcaed20bc6725384adbf40f500360dfb5538/example/cli/src/main.rs#L105

Implement mutual attestation when communicating with TLS

Separete into diffirent mem tables

Currently, we have nested mem tables in enclave. It should be flattened to separate tables.
https://github.com/LayerXcom/anonify/blob/7d30617f93707b7268c094ce1b88df120b41317f/core/enclave/src/kvs/mod.rs#L19

Separate memory-db regions between contract addresses

Add nonce to QUOTE

Currently, a transfer function calls verifyReportSig function to check the X.509 certificate, but it's vulnerable to replay attacks. To fix the kind of attacks, nonce field in QUOTE struct should be filled.

Add terraform configurations to deploy an entire anonify system

Add terraform configurations to deploy an entire anonify system on Azure Confidential Computing.

ref: libra's terraform directory

Randomize ciphertexts permutation in Tx

Add more decent tls configuration

Add more decent tls configuration in enclave.

Implement binder enclave lib to minimize ecall/ocall interface

ref: https://github.com/apache/incubator-teaclave/tree/develop/binder

Remove circle CI webhook

[enclave] Remove unnecessary hash of KVS's Key

just implement trait K: Hash + Eq to (UserAddress, MemId) .

https://github.com/LayerXcom/anonify/blob/87ed616592cfa2ec5c377fdfd438536dfc11c44a/core/enclave/src/kvs/mod.rs#L17-L29

Consider serialization libraries

Currently, it's used parity-scale-codec, which is compatible with no-std environment. Or we can use serde ecosystem.

Convert to using 'once_cell' instead of 'lazy_static' for globals

Convert to using 'once_cell' instead of 'lazy_static' for globals.
https://github.com/matklad/once_cell

Fix to call `HttpsClient` to use non-blocking communications

https://github.com/LayerXcom/anonify/blob/70d25938f79fbc9cc6ace350f461d1ee7f031818/core/enclave/src/attestation.rs#L51-L54

Remove access right from deploy and register api

Access right has been no longer needed to deploy and register api.
https://github.com/LayerXcom/anonify/blob/d67872eef8f1feb01738340bf750da03be9505b8/example/api/src/lib.rs#L20-L22

Add FixedSize trait to inner state

Each user state should be fixed size so that ciphertexts are indistinguishable.
inner_state may be dynamic size, so it needed to be limited by adding the FixedSize trait.
https://github.com/LayerXcom/anonify/blob/9b9abb38e9904247b618ebe371dacc51df3011f7/core/enclave/src/state.rs#L32

layerxcom / confidential-computing-modules Goto Github PK

confidential-computing-modules's People

Contributors

Stargazers

Watchers

Forkers

confidential-computing-modules's Issues

Recommend Projects

Recommend Topics

Recommend Org