ccc-certifier-framework / certifier-framework-for-confidential-computing

The Confidential Computing Certifier Framework consists of a client API called the Certifier-API and server-based policy evaluation called the Certifier Service. It simplifies and unifies programming and operations support for multi-vendor Confidential Computing platforms by providing support for scalable, policy-driven trust management including
Apache License 2.0
56 stars 16 forks source link

(#174) Initial support to parametrize public-key and symmetric-key algorithms. #232

Closed gapisback closed 11 months ago

gapisback commented 11 months ago

This commit lays down the plumbing to parametrize the names of the public-key and symmetric-key algorithms that will be used by the simple_app. Currently, these are hard-coded to 'Enc_method_rsa_2048' and 'Enc_method_aes_256_cbc_hmac_sha256', respectively.

This commit now supports --public_key_alg and --symmetric_key_alg flags that can be supplied to the simple_app/example_app.exe program.

An initial list of char *Enc_public_key_algorithms[] and char *Enc_symmetric_key_algorithms[] has been created in src/certifier_algorithms.cc. The idea is that we can run test-executions choosing pairs of these algorithms to drive the simple_app.

High-level changes:

gapisback commented 11 months ago

Hi, @jlmucb - I did a minor rework of this change-set subsequent to our discussion this morning.

See the diffs applied in this commit.

There are still some things that do not work:

  1. Using ecc-384 as a public-key algorithm name.
  2. Using any one of these as an authenticated symmetric-key algorithm name: aes-128-cbc-hmac-sha256, or aes-256-cbc-hmac-sha384, aes-256-gcm. These run into limitations as documented in run_example.sh around L3214.

I'd like to get the bulk of the rest of this testing / refactoring machinery reviewed and merged.

Then, you / I can separately investigate why the choice of these diff crypto algorithms is not working.