7. March 2023

[dimakuv]

Agenda

(please write your proposed agenda items in comments under this discussion)

• Woju: gramine-sgx-otk presentation

Misc

• People from Fortanix: Deepa Prabhakar, Nirjhar Roy.

  • Deepa: We would like to contribute to the Gramine project, from Fortanix.
  • Nirjhar: From 2020, I was a part of the Gramine/Graphene fork at Fortanix. I will be submitting patches to Gramine.
  • Deepa: Currently only Nirjhar will contribute. In the future, there will be one more person.
  • Mona: Gramine is a technically challenging project, do you also have any expert overseeing this effort?
    • Deepa: Currently only Nirjhar will work on this.
  • Mona: let us introduce the SGX/Gramine team on this call. [everyone introduces him/herself]

• Benny: quick update on doc restructuring. Paul rebased on top of the current docs state. We will soon submit a PR.

Woju: gramine-sgx-otk presentation

This tool is for Gramine SGX OTK (One-Time Key) signing.

• Woju explains the tool:
  • [shows a presentation]
  • Rationale: signing key must be protected, e.g. with local HSM, cloud HSM, controls, audits ... Also, what if you sign something wrong, then you need to revoke the key and re-sign everything (that was previously signed with this key)
  • Mona: are you saying that MRSIGNER is useless?
    • Woju: I don't say it's useless; it could be used in some scenarios; but it is sub-optimal and hard-to-use due to the reasons above.
  • Back to presentation: MRSIGNER is not needed, if you check MRENCLAVE.
  • Key idea: RSA key must be generated once, then sign the enclave, then RSA key is deleted forever.
  • [shows demo]

[woju]

gramine-otk-sign.pdf
^ The presentation