harald/teepot
1
0
Fork 0
mirror of https://github.com/matter-labs/teepot.git synced 2025-07-21 07:03:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
Nix, crates and tools for TEE handling
304 commits 22 branches 61 tags 2.2 MiB
Find a file
Patryk Bęza 9bf40c9cb9
feat(tee): use hex deserialization for RPC requests 
Following Anton's suggestion, we have switched to hex serialization for
API/RPC requests and responses. Previously, we used default JSON
serialization for Vec<u8>, which resulted in a lengthy comma-separated
list of integers.

This change standardizes serialization, making it more efficient and
reducing the size of the responses. The previous format, with a series
of comma-separated integers for pubkey-like fields, looked odd.

Then:
```
curl -X POST\
     -H "Content-Type: application/json" \
     --data '{"jsonrpc": "2.0", "id": 1, "method": "unstable_getTeeProofs", "params": [491882, "Sgx"] }' \
        https://mainnet.era.zksync.io
{"jsonrpc":"2.0","result":[{"attestation":[3,0,2,0,0,0,0,0,10,<dozens of comma-separated integers here>
```

Now:
```
$ curl -X POST \
       -H "Content-Type: application/json" \
       --data '{"jsonrpc": "2.0", "id": 1, "method": "unstable_getTeeProofs", "params": [1, "sgx"] }' \
          http://localhost:3050
{"jsonrpc":"2.0","result":[{"l1BatchNumber":1,"teeType":"sgx","pubkey":"0506070809","signature":"0001020304","proof":"0a0b0c0d0e","provedAt":"2024-09-16T11:53:38.253033Z","attestation":"0403020100"}],"id":1}
```

This change needs to be deployed in lockstep with:
https://github.com/matter-labs/zksync-era/pull/2887.
2024-09-18 14:10:21 +02:00
.github chore: tag container with git tag 2024-09-17 14:48:49 +02:00
assets feat: attestation test on azure and default dcap 2024-03-07 16:05:27 +01:00
bin feat(tee): use hex deserialization for RPC requests 2024-09-18 14:10:21 +02:00
crates chore: Release 2024-09-16 17:01:14 +02:00
examples feat: add Kubernetes pod spec for vault-unseal and update docs 2024-08-07 14:46:10 +02:00
packages chore: add extra startup information to unseal and admin enclaves 2024-09-04 09:47:20 +02:00
shells/teepot chore: prepare release tags 2024-09-16 16:14:26 +02:00
.dockerignore feat: initial commit 2024-02-09 10:10:53 +01:00
.gitignore feat: initial commit 2024-02-09 10:10:53 +01:00
Cargo.lock feat(tee): use hex deserialization for RPC requests 2024-09-18 14:10:21 +02:00
Cargo.toml chore: Release 2024-09-16 17:01:14 +02:00
deny.toml Whitelist CC0-1.0 license 2024-07-01 15:23:15 +02:00
flake.lock chore: update flake.lock 2024-09-03 13:24:19 +02:00
flake.nix feat(verify-attestation): RPC attestation and batch signature verification binary 2024-08-30 12:14:55 +02:00
LICENSE-APACHE feat: initial commit 2024-02-09 10:10:53 +01:00
LICENSE-MIT feat: initial commit 2024-02-09 10:10:53 +01:00
README.md docs: adapt README.md to reality 2024-07-02 13:14:36 +02:00
rust-toolchain.toml chore(deps): update to rust version 1.78 2024-06-10 13:09:05 +02:00
taplo.toml chore: prepare release tags 2024-09-16 16:14:26 +02:00
teepot-crate.nix feat(verify-attestation): RPC attestation and batch signature verification binary 2024-08-30 12:14:55 +02:00

README.md

teepot

Key Value store in a TEE with Remote Attestation for Authentication

Introduction

This project is a key-value store that runs in a Trusted Execution Environment (TEE) and uses Remote Attestation for Authentication. The key-value store is implemented using Hashicorp Vault running in an Intel SGX enclave via the Gramine runtime.

Parts of this project

  • teepot: The main rust crate that abstracts TEEs and key-value stores.
  • tee-vault-unseal: An enclave that uses the Vault API to unseal a vault as a proxy.
  • vault-unseal: A client utility, that talks to tee-vault-unseal to unseal a vault.
  • tee-vault-admin: An enclave that uses the Vault API to administer a vault as a proxy.
  • vault-admin: A client utility, that talks to tee-vault-admin to administer a vault.
  • teepot-read : A pre-exec utility that reads from the key-value store and passes the key-value pairs as environment variables to the enclave.
  • teepot-write : A pre-exec utility that reads key-values from the environment variables and writes them to the key-value store.
  • verify-attestation: A client utility that verifies the attestation of an enclave.
  • tee-key-preexec: A pre-exec utility that generates a p256 secret key and passes it as an environment variable to the enclave along with the attestation quote containing the hash of the public key.

Development

Prerequisites

Install nix.

In ~/.config/nix/nix.conf

experimental-features = nix-command flakes
sandbox = true

or on nixos in /etc/nixos/configuration.nix add the following lines:

{
  nix = {
    extraOptions = ''
      experimental-features = nix-command flakes
      sandbox = true
    '';
  };
}

Develop

$ nix develop

optionally create .envrc for direnv to automatically load the environment when entering the directory:

$ cat <<EOF > .envrc
use flake .#teepot
EOF
$ direnv allow

Format for commit

$ nix run .#fmt

Build as the CI would

$ nix run github:nixos/nixpkgs/nixos-23.11#nixci

Build and test individual container

See the packages directory for the available packages and containers.

$ nix build -L .#container-self-attestation-test-sgx-azure
[...]
teepot-self-attestation-test-sgx-azure-manifest-app-customisation-layer> Measurement:
teepot-self-attestation-test-sgx-azure-manifest-app-customisation-layer>     eaaabf210797606bcfde818a52e4a434fbf4f2e620d7edcc7025e3e1bbaa95c4
[...]
$ export IMAGE_TAG=$(docker load < result | grep -Po 'Loaded image.*: \K.*')
$ docker run -v $(pwd):/mnt -i --init --rm $IMAGE_TAG "cp app.sig /mnt"
$ nix shell github:matter-labs/nixsgx#gramine -c gramine-sgx-sigstruct-view app.sig
Attributes:
    mr_signer: c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d
    mr_enclave: eaaabf210797606bcfde818a52e4a434fbf4f2e620d7edcc7025e3e1bbaa95c4
    isv_prod_id: 0
    isv_svn: 0
    debug_enclave: False