From 4e38d45a4174f2d286258d00e44a8c251f8ede14 Mon Sep 17 00:00:00 2001 From: Andras Slemmer Date: Thu, 15 Jun 2017 12:04:59 +0100 Subject: [PATCH] Address comments #2 --- .idea/compiler.xml | 2 ++ .../kotlin/com/r3cev/sgx/config/ToolConfig.kt | 18 ++++++++++-- .../main/kotlin/com/r3cev/sgx/hsmtool/Main.kt | 4 +-- sgx-jvm/noop-enclave/CMakeLists.txt | 2 +- sgx-jvm/noop-enclave/README.md | 29 +++++++++++++------ 5 files changed, 41 insertions(+), 14 deletions(-) diff --git a/.idea/compiler.xml b/.idea/compiler.xml index d0973508de..61d88634d8 100644 --- a/.idea/compiler.xml +++ b/.idea/compiler.xml @@ -75,6 +75,8 @@ + + diff --git a/sgx-jvm/hsm-tool/src/main/kotlin/com/r3cev/sgx/config/ToolConfig.kt b/sgx-jvm/hsm-tool/src/main/kotlin/com/r3cev/sgx/config/ToolConfig.kt index 25a5e8487f..75571ca9ee 100644 --- a/sgx-jvm/hsm-tool/src/main/kotlin/com/r3cev/sgx/config/ToolConfig.kt +++ b/sgx-jvm/hsm-tool/src/main/kotlin/com/r3cev/sgx/config/ToolConfig.kt @@ -10,7 +10,7 @@ import java.nio.file.Paths import kotlin.system.exitProcess enum class Mode { - GenerateKey, + GenerateSgxKey, Sign } @@ -33,6 +33,7 @@ data class ToolConfig(val config: Config) { } catch (e: Exception) { println(e.message) parser.printHelpOn(System.out) + printModeHelp() exitProcess(1) } @@ -93,7 +94,10 @@ data class ToolConfig(val config: Config) { requireNotNull(signatureOutputPath) requireNotNull(publicKeyOutputPath) } - Mode.GenerateKey -> { + Mode.GenerateSgxKey -> { + require(sourcePath == null) + require(signatureOutputPath == null) + require(publicKeyOutputPath == null) } } } @@ -113,3 +117,13 @@ data class ToolConfig(val config: Config) { } } + +fun printModeHelp() { + val message = listOf( + "This tool may be run in two modes, --mode=GenerateSgxKey and --mode=Sign.", + "Both may take --profile as an argument to indicate what HSM profile to use (see sgxtool.cfg)", + "--mode=Sign expects --sourcePath={path to blob to sign}, --signatureOutputPath={path to result signature} and --publicKeyOutputPath={path to output public key}.", + "Providing any of these arguments in --mode=GenerateSgxKey results in an error." + ) + println(message.joinToString("\n")) +} diff --git a/sgx-jvm/hsm-tool/src/main/kotlin/com/r3cev/sgx/hsmtool/Main.kt b/sgx-jvm/hsm-tool/src/main/kotlin/com/r3cev/sgx/hsmtool/Main.kt index 631ce28dd8..c1428f5f69 100644 --- a/sgx-jvm/hsm-tool/src/main/kotlin/com/r3cev/sgx/hsmtool/Main.kt +++ b/sgx-jvm/hsm-tool/src/main/kotlin/com/r3cev/sgx/hsmtool/Main.kt @@ -47,7 +47,7 @@ fun sign(config: ToolConfig) { } } -fun generateKey(config: ToolConfig) { +fun generateSgxKey(config: ToolConfig) { val generateFlag = if (config.overwriteKey) { println("!!! WARNING: OVERWRITING KEY NAMED ${config.keyName} !!!") CryptoServerCXI.FLAG_OVERWRITE @@ -102,7 +102,7 @@ fun main(args: Array) { try { when (config.mode) { Mode.Sign -> sign(config) - Mode.GenerateKey -> generateKey(config) + Mode.GenerateSgxKey -> generateSgxKey(config) } println("Done!") } catch (exception: Throwable) { diff --git a/sgx-jvm/noop-enclave/CMakeLists.txt b/sgx-jvm/noop-enclave/CMakeLists.txt index cbd8ba5a61..33e82c9cd6 100644 --- a/sgx-jvm/noop-enclave/CMakeLists.txt +++ b/sgx-jvm/noop-enclave/CMakeLists.txt @@ -142,7 +142,7 @@ add_custom_target(signed-hsm DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/${ENCLAVE_SIGNE # HSM KEY add_custom_command( OUTPUT __generate-key-hsm-dummy__ - COMMAND java -jar ${HSM_SGX_TOOL} --mode=GenerateKey --profile=\${PROFILE} \$\(shell bash -c '[[ \${OVERWRITE} = "true" ]] && echo "--overwriteKey"' \) + COMMAND java -jar ${HSM_SGX_TOOL} --mode=GenerateSgxKey --profile=\${PROFILE} \$\(shell bash -c '[[ \${OVERWRITE} = "true" ]] && echo "--overwriteKey"' \) ) add_custom_target(generate-key-hsm DEPENDS __generate-key-hsm-dummy__) # /HSM KEY diff --git a/sgx-jvm/noop-enclave/README.md b/sgx-jvm/noop-enclave/README.md index b073495423..c13cacf7cd 100644 --- a/sgx-jvm/noop-enclave/README.md +++ b/sgx-jvm/noop-enclave/README.md @@ -10,17 +10,28 @@ How to run The following Makefile targets execute different steps in the signing process and output into build/ -`make unsigned` will build the unsigned enclave (noop\_enclave.unsigned.so). + +* `make unsigned` will build the unsigned enclave (noop\_enclave.unsigned.so). + The following targets use OpenSSL instead of the HSM: -`make signed-openssl` will sign the unsigned enclave with openssl using selfsigning.pem (noop\_enclave.signed.openssl.so). -`make sigstruct-openssl` will extract the SIGSTRUCT into a blob as well as a pretty printed txt from the openssl signed enclave (noop\_enclave.sigstruct.openssl.bin, noop\_enclave.sigstruct-pretty.openssl.txt). + +* `make signed-openssl` will sign the unsigned enclave with openssl using selfsigning.pem (noop\_enclave.signed.openssl.so). + +* `make sigstruct-openssl` will extract the SIGSTRUCT into a blob as well as a pretty printed txt from the openssl signed enclave (noop\_enclave.sigstruct.openssl.bin, noop\_enclave.sigstruct-pretty.openssl.txt). + The following targets use the HSM. They require an extra `PROFILE=[dev|prod]` argument to indicate whether to use a local HSM simulator or the real thing. -`make generate-key-hsm PROFILE=[dev|prod] [OVERWRITE=true]` will generate a fresh key for the profile. By default this will not overwrite an existing key, for that pass in MODE=overwrite. -`make signed-hsm PROFILE=[dev|prod]` will sign the unsigned enclave with the HSM. This target requires authentication (noop\_enclave.signed.hsm.so). -`make sigstruct-hsm PROFILE=[dev|prod]` will extract the SIGSTRUCT into a blob as well as a pretty printed txt from the HSM signed enclave (noop\_enclave.sigstruct.hsm.bin, noop\_enclave.sigstruct-pretty.hsm.txt). -`make noop_test` will create a test binary that loads an enclave and runs the noop ECALL inside it. For example: -`./build/noop_test ./build/noop_enclave.signed.openssl.so` -will run the noop ECALL using the openssl signed enclave. +* `make generate-key-hsm PROFILE=[dev|prod] [OVERWRITE=true]` will generate a fresh key for the profile. By default this will not overwrite an existing key, for that pass in OVERWRITE=true. + +* `make signed-hsm PROFILE=[dev|prod]` will sign the unsigned enclave with the HSM. This target requires authentication (noop\_enclave.signed.hsm.so). + +* `make sigstruct-hsm PROFILE=[dev|prod]` will extract the SIGSTRUCT into a blob as well as a pretty printed txt from the HSM signed enclave (noop\_enclave.sigstruct.hsm.bin, noop\_enclave.sigstruct-pretty.hsm.txt). + + +* `make noop_test` will create a test binary that loads an enclave and runs the noop ECALL inside it. For example: + + `./build/noop_test ./build/noop_enclave.signed.openssl.so` + + will run the noop ECALL using the openssl signed enclave.