Running Rust Code in SGX

This repo is a demo for running rust code in an Intel SGX enclave using the Gramine framework.

Setting up an SGX enabled VM on Azure

Refer to this guide for how to setup a VM with Intel SGX capabilities via Microsoft Azure cloud services and install Gramine

Build and Run

Gramine let's you build in a way to run the code outside of an SGC enclave (useful for testing).

# build then run the program outside of SGX
make
gramine-direct sgx-rust

Add the SGX flag to build properly for SGX and tell Gramine to run it.

# build the program and the final manifest then run inside SGX
make SGX=1
gramine-sgx sgx-rust

Demo Program

The demo program in this example is a simple server that accepts two different request endpoints.

/attest

The first endpoint is /attest which accepts any amount of bytes and has the program generate an SGX "quote" with the bytes places in the "report data". A "qoute" is a blob of data signed by the hardwares special embedded keys and includes many details about the enclave including it's starting memory state, which includes all the programs binaries when the enclave was started, and a special "report data" section that this code can write to. The key idea here is to first verify the "quote" actually came from a secure enclave running on Intel trusted hardware, then check the enclaves starting code/state (known as the enclaves "measurement"). Once those two pieces are verified, you know that any "report data" that shows up in the "quote" is meaningful (note that only the program running in the enclave can generate "quotes"). A real SGX program will want to actually do something before placing data in the "report data" and generating a "quote". For example, a program might accept two numbers with the intent to add them, then in the "report data" it might place data that decodes as "I added numbers X and Y to get Z". The "report data" can only fit 64 bytes, so if you provide more than this in this demo, the program will hash the data first.

/verify

The second endpoint is /verify which accepts an SGX "quote" (can be from a different machine running completely different code) and verifies it's integrity to a hardcoded Intel root certificate. In addition to the raw "quote", additional data must be provided to the endpoint and is referred to as "collateral". This "collateral" consists of a chain of different certificates, signatures, and revocation lists that ultimately leads to a final verification against the Intel root certificate and the current timestamp (note that this root certificate is not immune to expiration and possible rotation so hardcoding it is not the best practice for long term sustainability). This "collateral" data is provided by Intel and can mostly be obtained through multiple calls to a free internet REST API, however some of the data requires an API key. You'll see later on in the testing section that the demo gets around needing an API key by hardcoding some of the certificates for now.

Testing

An integration test suite is included in this repo to demo interacting with the program running in SGX. This test calls the /attest endpoint, then verifies the integrity of the received quote, then calls the /verify endpoint to check that the program running in SGX can also verify SGX quotes.

# run integration test and demo
cargo test -- --nocapture

You should see output similar to this.

Quote Verified!
Measurement: 0xdce40a171698ced0eebd18b96882631103066183815d5b148e65dc36770381d6
Report Data: 0x09e8a69c2238a84af7d27483cbc3b6175976a278031df44651298d73e14e094e
TCB Status: Software Hardening Needed

Quote Verified within the TEE!