Open jmp0x7c00 opened 2 years ago
Hi @jmp0x7c00 , thanks for the note! The code is meant to be a research prototype for evaluation purposes so debugging statements like this is probably all over the place. Don't use this code in production!
That said, we do have logging level support in https://github.com/bl4ck5un/Town-Crier/blob/master/src/Enclave/log.h so you can modify logging to suite your needs.
mbedtls logging can be configured by
ok, I see. Thanks for your quick replay.!:)
If we use Town-Crier in product environment, we have to modify its code a little.
here is an another leak-causing code, the decrypted message will be hexdumped outside enclave.
const string decrypt_query(const uint8_t* data, size_t data_len) {
HybridEncryption dec_ctx;
ECPointBuffer tc_pubkey;
dec_ctx.queryPubkey(tc_pubkey);
string cipher_b64(string(data, data + data_len).c_str());
hexdump("encrypted query: ", data, data_len);
try {
HybridCiphertext cipher = dec_ctx.decode(cipher_b64);
vector<uint8_t> cleartext;
dec_ctx.hybridDecrypt(cipher, cleartext);
// !!!===================> leak
hexdump("decrypted message", &cleartext[0], cleartext.size());
// decrypted message is the base64 encoded data
string encoded_message(cleartext.begin(), cleartext.end());
return encoded_message;
}
hi,sir,
Town-Crier is an awesome project, I love it.but I think there maybe a security issue here , in file
Enclave/SSLClient.c
:Intel SGX can protect our sensitve data in enclave, however, we have to write our code carefully in case of leaking them by invoking ocall. I think we have to comment these lines before we use Town-Crier in release mode.
I think one solution is that we can define a DEBUG macro to decide wether to print them.