Problem: no proof that a keypair was generated inside NE (fixes #92) #95
Conversation
tomtau
requested review from
allthatjazzleo,
linfeng-crypto,
brianatcrypto,
borischeuk-crypto and
calvinaco
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
| from cose.keys.ec2 import EC2 | ||
| from cose.keys.curves import P384 | ||
| from cose.messages import Sign1Message | ||
| from Crypto.Util.number import long_to_bytes |
There was a problem hiding this comment.
blacklist: The pyCrypto library and its module long_to_bytes are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.
(at-me in a reply with help or ignore)
There was a problem hiding this comment.
I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.
There was a problem hiding this comment.
(this script is only for illustration -- when there's an official AWS verification functionality in AWS Rust API, it can potentially be used instead)
yeah, at least basic processing should be possible with https://crates.io/crates/aws-nitro-enclaves-cose + https://github.com/aws/aws-nitro-enclaves-nsm-api/blob/main/nsm-io/src/lib.rs#L298 -- I can open an issue for it |
Solution: - extended response for keygen in the helper + extra comments/small refactor - nitro enclave returns an attestation doc for the generated pubkey + used AWS KMS key id - added a small Python verification script to illustrate how the attestation doc payload can be processed
Solution: