4 ms·

My team and I are deploying a zero trust independently verifiable secret forwarding system on AWS Nitro Enclave, please ask me anything. The idea is basic secr

My team and I are deploying a zero trust independently verifiable secret forwarding system on AWS Nitro Enclave, please ask me anything. The idea is basic secret forwarding - you want to send a secret to many destinations, but find it too cumbersome to encrypt it with each destination’s public key, or you might not have all the public keys in hand. To address this, we provide you with a code base running inside a Nitro Enclave. You have a KMS account, and you configure it to allow access only to 1) our code base hash AND 2) only when that signed code is running inside a certified Nitro Enclave. The enclave bootstraps itself on first run by generating a key pair and encrypting the private key with a data key from KMS. You can then send a secret to the enclave encrypted with its public key, and verifiably know exactly what’s going to happen. Only trusted code running inside the secure confines of the enclave would be able to decrypt and operate on the secret. There’s lots of gotchas - if you make a server in the enclave remember to use a server that binds on the VSOCK AF and port; on the host run socat or a systemd socket unit to translate HTTP/TCP calls into the enclave’s VSOCK. Make sure you enrich all requests passed into the enclave with all the data and encrypted artefacts it needs to work. Make sure to send the encrypted artefacts out from the enclave and store them safely. We do this for cinema movie distribution - filmmakers just send their movie’s encryption key to this system, and it sends it out to the public key of each projector in each screen in each theatre in the world. And big studios can verify that their billion dollar movies aren’t going anywhere other than their chosen rules.

Thom2000 4y ago
It seems like everything you have described could be done with TPM: creating a signing key for TLS mutual authentication (against the secret store) with policy that allows using that key only if system configuration did not change (PCR values stay consistent). Additionally TPMs allow remote attestation (via quotes and endorsement keys). So I'm wondering what's the advantage of Nitro Enclaves? Better out of the box tooling?
- electroly 4y ago
  I'm not OP, but AWS introduced Nitro Enclaves about two years before Nitro TPM, which is a relatively recent addition. It's likely that TPM wasn't available in AWS at the time of OP's original development. Nitro TPM is not available at all on Graviton 1 or 2; only the newest Graviton 3.
  - Thom2000 4y ago
    That clarifies some matters - thanks!
- sudhirj 4y ago
  I’ll check out the TPM, but our big draw with the Enclave system is being able to run general purpose code (Python / Go) inside a secure isolated environment. The earlier system we had was SEE machine on a HSM and required a special compiler to run - I haven’t seen the Nitro TPM just yet, but I doubt I’d be able run a container inside the boundaries of the TPM.
  - phw 4y ago
    In case it's helpful: I'm maintaining a tool kit that makes it possible to run unmodified, general-purpose code inside Nitro enclaves: https://github.com/brave/nitriding https://github.com/brave/nitriding
Veserv 4y ago
How did you verify and validate that a AWS Nitro Enclave actually provides isolation and attestation guarantees? Do they provide certifications or audits confirming conformance to multi-level security guarantees? Or do they provide you detailed specifications allowing you to evaluate that yourselves? Did you run red team exercises that resulted in no detected deficiencies as would be required by a multi-level security claim?
- sudhirj 4y ago
  Trust in AWS and Nitro HyperVisor system is taken for granted here, if that’s what you mean. We don’t necessarily examine AWS’s code or hardware, we’ll just have to take their word for it. Which is what we and our customers do already, when we run our workloads on it. We know this is a problem, but this is where we’re ok with drawing the line. If you’ve seen Reflections on Trusting Trust you’ll know we have to draw the line somewhere.
  - Veserv 4y ago
    Do they provide any third party certifications with teeth, legally binding guarantees, or contractual guarantees supporting the claims you are relying on?
    - sudhirj 4y ago
      Not right now, no. From what I've seen from our previous suppliers (HSMs from Thales) no one will take on liability (if that's what you mean). The trust instead relies on the FIPS-140 certification process - certified devices are sold as-is. In the case of the cloud I haven't seen FIPS certification of any of the internal systems from cloud providers yet. This need for certification needs to be balanced against usability - it's relatively easier to certify a hardware design that has no compute, or a physically isolated CPU and memory like a SEE Machine, but it's also much less useful. We prefer general purpose machines that have the same strength barriers that we already know are being deployed to protect customers from each other, that are being probed and tested all day every day both by AWS internally and by bad actors trying to steal other people's data. The lack of known pending exploits, continuous patching by AWS and being battle tested on a massive scale is more important to us than a FIPS certification at this point. Although if AWS managed to get FIPS to certify the Nitro system it would be a big plus.
s_dev 4y ago
Evervault?
- sudhirj 4y ago
  No, QubeWire https://www.qubewire.com/ https://www.qubewire.com/

Thom2000 4y ago

It seems like everything you have described could be done with TPM: creating a signing key for TLS mutual authentication (against the secret store) with policy that allows using that key only if system configuration did not change (PCR values stay consistent). Additionally TPMs allow remote attestation (via quotes and endorsement keys). So I'm wondering what's the advantage of Nitro Enclaves? Better out of the box tooling?

electroly 4y ago
I'm not OP, but AWS introduced Nitro Enclaves about two years before Nitro TPM, which is a relatively recent addition. It's likely that TPM wasn't available in AWS at the time of OP's original development. Nitro TPM is not available at all on Graviton 1 or 2; only the newest Graviton 3.
- Thom2000 4y ago
  That clarifies some matters - thanks!
sudhirj 4y ago
I’ll check out the TPM, but our big draw with the Enclave system is being able to run general purpose code (Python / Go) inside a secure isolated environment. The earlier system we had was SEE machine on a HSM and required a special compiler to run - I haven’t seen the Nitro TPM just yet, but I doubt I’d be able run a container inside the boundaries of the TPM.
- phw 4y ago
  In case it's helpful: I'm maintaining a tool kit that makes it possible to run unmodified, general-purpose code inside Nitro enclaves: https://github.com/brave/nitriding https://github.com/brave/nitriding

Veserv 4y ago

How did you verify and validate that a AWS Nitro Enclave actually provides isolation and attestation guarantees? Do they provide certifications or audits confirming conformance to multi-level security guarantees? Or do they provide you detailed specifications allowing you to evaluate that yourselves? Did you run red team exercises that resulted in no detected deficiencies as would be required by a multi-level security claim?

sudhirj 4y ago
Trust in AWS and Nitro HyperVisor system is taken for granted here, if that’s what you mean. We don’t necessarily examine AWS’s code or hardware, we’ll just have to take their word for it. Which is what we and our customers do already, when we run our workloads on it. We know this is a problem, but this is where we’re ok with drawing the line. If you’ve seen Reflections on Trusting Trust you’ll know we have to draw the line somewhere.
- Veserv 4y ago
  Do they provide any third party certifications with teeth, legally binding guarantees, or contractual guarantees supporting the claims you are relying on?
  - sudhirj 4y ago
    Not right now, no. From what I've seen from our previous suppliers (HSMs from Thales) no one will take on liability (if that's what you mean). The trust instead relies on the FIPS-140 certification process - certified devices are sold as-is. In the case of the cloud I haven't seen FIPS certification of any of the internal systems from cloud providers yet. This need for certification needs to be balanced against usability - it's relatively easier to certify a hardware design that has no compute, or a physically isolated CPU and memory like a SEE Machine, but it's also much less useful. We prefer general purpose machines that have the same strength barriers that we already know are being deployed to protect customers from each other, that are being probed and tested all day every day both by AWS internally and by bad actors trying to steal other people's data. The lack of known pending exploits, continuous patching by AWS and being battle tested on a massive scale is more important to us than a FIPS certification at this point. Although if AWS managed to get FIPS to certify the Nitro system it would be a big plus.

s_dev 4y ago

Evervault?

sudhirj 4y ago
No, QubeWire https://www.qubewire.com/ https://www.qubewire.com/