20. June 2023

[dimakuv]

Agenda

(please write your proposed agenda items in comments under this discussion)

• Mikko: Confidential Containers KBS as a secrets provider (see Confidential Containers KBS as a secrets provider #1334)

Mikko: Confidential Containers KBS as a secrets provider

< shows presentation >

CoCo Attestation Stack contains:

• Attestation Service (AS)
• Key Broker Service (KBS)

AS is used to verify evidences (e.g. SGX quotes) and KBS is the one who talks to the Gramine app using a standard CoCo KBS protocol.

The KBS protocol has the following APIs: auth, attest, unwrap_key, get_resource, ...

Intel Amber project is a production AS example.

Enclave-CC project is the client of CoCo KBS (pulls secrets).

Mikko created an LD_PRELOADed lib that reuses KBS API client and the SGX attestation driver from the CoCo repos, and adds on top of it the Gramine-specific code.

Mikko created his own libsecret_prov.so that only has one API: setting the PF wrap key. So Mikko's lib has only a subset of "reference Gramine SecretProv" library, and thus the name is misleading.

Because Mikko reuses CoCo Rust crates, his libsecret_prov.so is currently pretty big, ~12MB in binary size.

Alibaba is pushing for CoCo KBS in production, but it's in early stages -- to be seen how it will be used by companies.