Error: Secret Provisioning failed during mbedtls_ssl_handshake with error -10240

[Gedoy9793]

I want to run ra-tls-secret-prov example, and get a error:

Server:

--- Reading the master key for encrypted files from 'wrap_key' ---
--- Starting the Secret Provisioning server on port 4433 ---
client_connection: Secret Provisioning failed during mbedtls_ssl_handshake with error -10240
client_connection: ra_tls_verify_callback_results:
    attestation_scheme=1, err_loc=1,
client_connection:     epid.ias_enclave_quote_status=

Client:

Gramine is starting. Parsing TOML manifest file, this may take some time...
-----------------------------------------------------------------------------------------------------------------------
Gramine detected the following insecure configurations:

  - sgx.debug = true                           (this is a debug enclave)

Gramine will continue application execution, but this configuration must not be used in production!
-----------------------------------------------------------------------------------------------------------------------

secret_provision_start: Secret Provisioning failed during mbedtls_ssl_handshake with error -80
secret_provision_constructor: Secret provisioning failed, terminating the whole process

This is my steps:

1. Install a clear ubuntu-22.04.3-live-server-amd64
2. Init. Such as apt update, apt upgrade.
3. Run the command which copied from Gramine installation options:

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

4. Install some other package:

apt install make gcc pkgconf libsgx-aesm-epid-plugin

5. Go to the path of this example:

cd /root/gramine/CI-Examples/ra-tls-secret-prov

6. Make:

make app epid RA_TYPE=epid RA_CLIENT_SPID=xxxx RA_CLIENT_LINKABLE=1

7. Set a env:

RA_TLS_EPID_API_KEY=xxxx

8. Start server and client in their respective shell.
9. Get a error like what's written before.

This is a result from is-sgx-available:

# is-sgx-available
SGX supported by CPU: true
SGX1 (ECREATE, EENTER, ...): true
SGX2 (EAUG, EACCEPT, EMODPR, ...): false
Flexible Launch Control (IA32_SGXPUBKEYHASH{0..3} MSRs): true
SGX extensions for virtualizers (EINCVIRTCHILD, EDECVIRTCHILD, ESETCONTEXT): false
Extensions for concurrent memory management (ETRACKC, ELDBC, ELDUC, ERDINFO): false
CET enclave attributes support (See Table 37-5 in the SDM): false
Key separation and sharing (KSS) support (CONFIGID, CONFIGSVN, ISVEXTPRODID, ISVFAMILYID report fields): false
Max enclave size (32-bit): 0x80000000
Max enclave size (64-bit): 0x1000000000
EPC size: 0x2000000
SGX driver loaded: true
AESMD installed: true
SGX PSW/libsgx installed: true
#PF/#GP information in EXINFO in MISC region of SSA supported: false
#CP information in EXINFO in MISC region of SSA supported: false

[kailun-qin]

@Gedoy9793 Thanks for the question!

ra_tls_verify_callback_results:
attestation_scheme=1, err_loc=1

It seems that RA_TLS_EPID_API_KEY was not correctly parsed.

7. Set a env:
   RA_TLS_EPID_API_KEY=xxxx

Maybe you meant export RA_TLS_EPID_API_KEY=xxxx? (otherwise it won't take effect for the subsequent cmds)

[Gedoy9793]

THANKS!! It worked