Skip to content

Commit 56fbdf2

Browse files
maceipmaceip
committed
chore: notary now uses k1 curve
1 parent 7e76d91 commit 56fbdf2

File tree

4 files changed

+30
-17
lines changed

4 files changed

+30
-17
lines changed

‎crates/notary/server/build.rs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ use std::{env, process::Command};
22

33
fn main() {
44
if env::var("GIT_COMMIT_HASH").is_ok() && env::var("GIT_COMMIT_TIMESTAMP").is_ok() {
5-
return;
65
} else {
76
// Used to extract latest HEAD commit hash and timestamp for the /info endpoint
87
let output = Command::new("git")

‎crates/notary/server/src/server.rs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ use crate::{
4949
#[cfg(feature = "tee_quote")]
5050
use crate::tee::{ephemeral_keypair, quote};
5151

52-
/// Start a TCP server (with or without TLS) to accept notarization request for both TCP and WebSocket clients
52+
/// Start a TCP server (with or without TLS) to accept notarization request for
53+
/// both TCP and WebSocket clients
5354
#[tracing::instrument(skip(config))]
5455
pub async fn run_server(config: &NotaryServerProperties) -> Result<(), NotaryServerError> {
5556
// tee uses ephemeral key

‎crates/notary/server/src/tee.rs

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
1+
use base64::{engine::general_purpose::STANDARD, Engine};
12
use mc_sgx_dcap_types::QlError;
23
use once_cell::sync::OnceCell;
34
use serde::{Deserialize, Serialize};
45
use std::fs;
56

67
use crate::signing::AttestationKey;
7-
use p256::{ecdsa::SigningKey, PublicKey, elliptic_curve::sec1::ToEncodedPoint};
8+
use k256::ecdsa::{SigningKey, VerifyingKey as PublicKey};
89
use pkcs8::{DecodePrivateKey, EncodePrivateKey, LineEnding};
910
use rand_chacha::{
1011
rand_core::{OsRng, SeedableRng},
@@ -86,10 +87,15 @@ async fn gramine_quote() -> Result<Quote, QuoteError> {
8687
// Write to `/dev/attestation/target_info`
8788
fs::write("/dev/attestation/target_info", my_target_info)?;
8889

89-
//// Writing the pubkey to bind the instance to the hw (note: this is not mrsigner)
90+
//// Writing the pubkey to bind the instance to the hw (note: this is not
91+
//// mrsigner)
9092
fs::write(
9193
"/dev/attestation/user_report_data",
92-
PUBLIC_KEY.get().expect("pub_key_get").to_encoded_point(true).as_bytes()
94+
PUBLIC_KEY
95+
.get()
96+
.expect("pub_key_get")
97+
.to_encoded_point(true)
98+
.as_bytes(),
9399
)?;
94100

95101
//// Reading from the gramine quote pseudo-hardware `/dev/attestation/quote`
@@ -102,8 +108,8 @@ async fn gramine_quote() -> Result<Quote, QuoteError> {
102108
return Err(QuoteError::IntelQuoteLibrary(QlError::InvalidReport));
103109
}
104110

105-
//// Extract mrenclave: enclave image, and mrsigner: identity key bound to enclave
106-
//// https://github.com/intel/linux-sgx/blob/main/common/inc/sgx_quote.h
111+
//// Extract mrenclave: enclave image, and mrsigner: identity key bound to
112+
//// enclave https://github.com/intel/linux-sgx/blob/main/common/inc/sgx_quote.h
107113
let mrenclave = hex::encode(&quote[112..144]);
108114
let mrsigner = hex::encode(&quote[176..208]);
109115

@@ -124,16 +130,23 @@ pub fn ephemeral_keypair() -> (AttestationKey, String) {
124130
let signing_key = SigningKey::random(&mut rng);
125131
let pem_string = signing_key
126132
.clone()
127-
.to_pkcs8_pem(LineEnding::default())
133+
.to_pkcs8_pem(LineEnding::LF)
128134
.expect("to pem");
129135
let attkey = AttestationKey::from_pkcs8_pem(&pem_string).expect("from pem");
136+
let derk = signing_key
137+
.verifying_key()
138+
.to_encoded_point(true)
139+
.to_bytes();
140+
let b64k = STANDARD.encode(derk.as_ref());
141+
let pem = format!(
142+
"-----BEGIN PUBLIC KEY-----\n{}\n-----END PUBLIC KEY-----\n",
143+
b64k
144+
);
145+
130146
let _ = PUBLIC_KEY
131-
.set(PublicKey::from(*signing_key.verifying_key()))
147+
.set(*signing_key.verifying_key())
132148
.map_err(|_| "Public key has already been set");
133-
return (
134-
attkey,
135-
PublicKey::from(*signing_key.verifying_key()).to_string(),
136-
);
149+
return (attkey, pem);
137150
}
138151

139152
pub async fn quote() -> Quote {

‎crates/notary/server/tee/config/config.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
server:
2-
name: "tee.notary.codes"
2+
name: "notary.codes"
33
host: "0.0.0.0"
44
port: 7047
55
html-info: |
66
<head>
77
<meta charset="UTF-8">
88
<meta name="description" content="mpc-tls">
99
<meta name="keywords" content="tlsnotary, mpc, free">
10-
<meta name="author" content="tlsnotary">
10+
<meta name="author" content="notary">
1111
<meta name="viewport" content="width=device-width, initial-scale=1.0">
1212
</head>
1313
<body>
@@ -17,11 +17,11 @@ server:
1717
<path d="M63.871 76.7012H72.3871V34.2207H76.6452V76.7012H85.1613V25.7246H63.871V76.7012Z" fill="#243F5F"/>
1818
<path d="M38.3226 25.7246H59.6129V34.2207H46.8387V46.9649H59.6129V76.7012H38.3226V68.2051H51.0968V55.4609H38.3226V25.7246Z" fill="#243F5F"/>
1919
</svg>
20-
<h1>trusted execution environment based notary server</h1>
20+
<h1>notary server :: at your service</h1>
2121
<h3>tlsnotary {version}</h3>
2222
<blink>{public_key}</blink>
2323
<h4>remote attestation</h4>
24-
<a href="/{version}/info">available here</a>
24+
<a href="/v{version}/info">available here</a>
2525
</body>
2626
2727
notarization:

0 commit comments

Comments
 (0)