unseal data after enclave upgrade
(以下代码以 teaclave sdk 为例)
Intel SGX 提供了 sealing 的功能，同时根据 key policy 的不同提供了以下2种方式：
-
Seal to Current Enclave: This method binds the measurement of the current enclave, MRENCLAVE, to the key used by the sealing operation, using EGETKEY instruction. Therefore, only an enclave with the same MRENCLAVE will be able to generate the key to unseal the data. If any attribute related to the enclave has changed, the MRENCLAVE will also change. As a result, the sealing key will also change and the sealed data cannot be decrypted.
-
Seal to the Enclave Author: This method binds the identity of the enclave author, which is stored in the enclave’s MRSIGNER register at initialization time, to the sealing key derived from the Root Sealing Key using EGETKEY instruction. The Product ID of the enclave is also bound to the derived sealing key. Therefore, only an enclave with the same MRSIGNER measurement and the same Product ID can retrieve the sealing key and unseal the data.
There are two benefits of this mechanism over sealing to the enclave identity. First, it allows an enclave to be upgraded by the enclave author without a complex upgrade process to unlock data sealed to the previous version of the enclave and reseal it to the new version. Second, it allows enclaves from the same author to share sealed data.
基于 teaclave sdk 提供的 sealeddata samplecode 为例，实验一下在Enclave升级后，使用 MRSIGNER 的方式对原enclave sealing的数据进行 unsealing.
第一步： 对原始代码进行编译
make SGX_MODE=SW
查看 mrenclave 和 mrsigner
MRENCLAVE: 5fa74e68b21b6c5a348c2fcdea41b4c451d187625cc9997c93a398acf93a
MRSIGNER : 83d719e77deaca147f6baf62a4d77433c899db692f9c7ee1dfc8c7ce9e
第二步： 添加代码把 sealedlog 数据写到 local file
FILE *file = fopen("sealed_log.bin", "wb");
if(file == NULL) {
printf("Failed to open file for writing.\n");
return -1;
}
fwrite(sealed_log, 1, sealed_log_size, file);
fclose(file);
printf("Sealed log written to sealed_log.bin.\n");
这步骤不涉及enclave部分的变动，所以不算enclave升级。
第三步： 升级 enclave 我们只做简单的变动，把
println!("{:?}", data);
改为
println!("The plain Data: {:?}", data);
第四步： 编译，查看新的 mrenclave
MRENCLAVE: 4d7ef3ecf31ac357d93ab75a1e829e1db2dbc8713fee7afc64a68ffd42278
MRSIGNER : 83d719e77deaca147f6baf62a4d77433c899db692f9c7ee1dfc8c7ce9e
可以看到 MRENCLAVE 已经发生了变化， 在此表示进行了升级。
第五步： sealedlog 直接从 sealed_log.bin 中读取进行验证。
FILE *file = fopen("sealed_log.bin", "rb");
if(file == NULL) {
printf("Failed to open file for reading.\n");
return -1;
}
size_t read_size = fread(sealed_log, 1, sealed_log_size, file);
if(read_size != sealed_log_size) {
printf("Failed to read expected size from file.\n");
fclose(file);
return -1;
}
fclose(file);
printf("Sealed log read from sealed_log.bin.\n");
第六步： 查看log输出
[+] global_eid: 135055246622722
Sealed log read from sealed_log.bin.
create_sealeddata_for_fixed success ...
sealed_data.key_request.key_name 0x4
sealed_data.key_request.key_policy 0x2
sealed_data.plain_text_offset 0x14
sealed_data.aes_data.payload_size 0x14
The plain Data: RandDataFixed { key: 4660, rand: [202, 136, 69, 83, 198, 78, 57, 179, 91, 78, 129, 98, 82, 251, 116, 53] }
verify_sealeddata_for_fixed success ...
Length of encoded slice: 81
Encoded slice: [163, 99, 107, 101, 121, 25, 18, 52, 100, 114, 97, 110, 100, 144, 24, 31, 24, 122, 24, 168, 24, 201, 24, 105, 24, 41, 24, 146, 24, 254, 24, 71, 24, 190, 24, 204, 24, 212, 24, 199, 24, 188, 2, 24, 28, 99, 118, 101, 99, 144, 24, 31, 24, 122, 24, 168, 24, 201, 24, 105, 24, 41, 24, 146, 24, 254, 24, 71, 24, 190, 24, 204, 24, 212, 24, 199, 24, 188, 2, 24, 28]
RandDataSerializable { key: 4660, rand: [31, 122, 168, 201, 105, 41, 146, 254, 71, 190, 204, 212, 199, 188, 2, 28], vec: [31, 122, 168, 201, 105, 41, 146, 254, 71, 190, 204, 212, 199, 188, 2, 28] }
create_sealeddata_for_serializable success ...
sealed_data.key_request.key_name 0x4
sealed_data.key_request.key_policy 0x2
sealed_data.plain_text_offset 0x51
sealed_data.aes_data.payload_size 0x51
Length of encoded slice: 81
Encoded slice: [163, 99, 107, 101, 121, 25, 18, 52, 100, 114, 97, 110, 100, 144, 24, 31, 24, 122, 24, 168, 24, 201, 24, 105, 24, 41, 24, 146, 24, 254, 24, 71, 24, 190, 24, 204, 24, 212, 24, 199, 24, 188, 2, 24, 28, 99, 118, 101, 99, 144, 24, 31, 24, 122, 24, 168, 24, 201, 24, 105, 24, 41, 24, 146, 24, 254, 24, 71, 24, 190, 24, 204, 24, 212, 24, 199, 24, 188, 2, 24, 28]
RandDataSerializable { key: 4660, rand: [31, 122, 168, 201, 105, 41, 146, 254, 71, 190, 204, 212, 199, 188, 2, 28], vec: [31, 122, 168, 201, 105, 41, 146, 254, 71, 190, 204, 212, 199, 188, 2, 28] }
verify_sealeddata_for_serializable success ...
可以看到，升级后的enclave对之前sealing的数据进行了unsealing操作成功。