Leases #55
Leases #55
Conversation
jeffa5
force-pushed
the
leases
branch
2 times, most recently
from
bc77998
to
1abdda1
Compare
Doesn't currently work due to streams missing.
This makes it more consistent and allows us to use get_untrusted_host_time_v1. This function isn't static so we can't have our handlers be static either.
There was a problem hiding this comment.
Nice! I think the implications of using the time of the untrusted host (there's no secure time in the enclave) should be spelled out somewhere. This effectively means that a malicious operator could revoke a lease early or extend an existing one (i.e. there's an attack vector every time the app uses get_time_s). How bad is this? Should the API be extended for the client to pass in their current local time?
Yep the lack of secure timing is a bit of a nuisance. Since leases might typically be used for some sort of leader election I'd imagine that it could be a bit troublesome (constantly flipping leaders). I'm not sure if the clients that use the lease would be trusted enough to provide times either since they could maliciously give a time that invalidates other leases. Perhaps we could compromise, expose a way of clients also providing their current time in the request, and then comparing it to the local time from the OS. If they are not too different (within a configurable limit) then we know we can trust the timing somewhat. If they are too different just error out? Something to bear in mind and discuss going forwards. I'll make an issue. |
Fixes #21
Except #68