Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use SGX Sealing to encrypt random values generated by Enclave #63

Open
kss-espeo opened this issue Sep 19, 2019 · 0 comments
Open

Use SGX Sealing to encrypt random values generated by Enclave #63

kss-espeo opened this issue Sep 19, 2019 · 0 comments
Labels
enhancement New feature or request

Comments

@kss-espeo
Copy link
Collaborator

kss-espeo commented Sep 19, 2019

Currently, a process of generating random value in Enclave is vulnerable to man-in-the-middle attack - should attacker take control of a machine that hosts gardener-server, he could replace generated value with one of his choice.

To remedy that, we should use SGX Sealing mechanism to hardcode user's public key (assymetric cryptography, does not necessarily have anything to do with blockchain keys - even though it could) . This public key would be used to encrypt generated data in enclave and send it to the user - decrypting value with his private key would be user's responsibility.

Potential security risk: attacker could take control of user's public key, intercept gardener-server machine and generate encrypted value. This means that IF such attack is feasible, then instead of just hardcoding user's public key, we could go for Diffie-Hellman Key Exchange.

Finishing this task is the last milestone for SGX implementation in the context of RNG for gambling, since having it guarantees that the only Third Trusted Party in entire RNG process is Intel - user does not even have to trust a party that hosts gardener-server.

@kss-espeo kss-espeo added the enhancement New feature or request label Sep 19, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant