search

edgelesssys / ego

EGo is an open-source SDK that enables you to develop your own confidential apps in the Go programming language.
https://www.edgeless.systems/products/ego/
Mozilla Public License 2.0
516 stars 51 forks source link

File encryption #43

Open boudo opened 3 years ago

boudo commented 3 years ago

ego

Hi, Can I encrypt the test.txt file with EGo so that it is only accessible through the enclave or can I put it directly in the enclave?

thomasten commented 3 years ago

Hi, yes, you can encrypt the data before writing it to the file with the SealWith... functions from https://pkg.go.dev/github.com/edgelesssys/ego/ecrypto. This will use the SGX seal key, so it can only be decrypted by the enclave. One of the next versions of EGo will include an in-enclave-memory filesystem. Then you can put it directly in the enclave. You can already achieve this manually by using the MemMapFs from https://github.com/spf13/afero.

boudo commented 3 years ago

Hi, Thank you. I tested with SealWith... functions and also with afero, everything works fine. For one of the next versions of EGo, we must understand that there will be a configuration file that allows to tell EGo to put the test.txt file in the enclave without modifying the source code of the application?

thomasten commented 3 years ago

For one of the next versions of EGo, we must understand that there will be a configuration file that allows to tell EGo to put the test.txt file in the enclave without modifying the source code of the application?

Yes, that will be possible. There is already a brief documentation how this will work: https://github.com/edgelesssys/ego/blob/master/doc/ego_cli.md#enclave-configuration-file So you will be able to mount some paths as memfs and writing to these will never leave the enclave.

boudo commented 3 years ago

Great, thank you for your answers. It is very interesting.

thomasten commented 3 years ago

@boudo The memfs feature is now available in v0.2

boudo commented 3 years ago

Hi @thomasten, I suppose that the next version will support data sealing for hostfs without modifying the application code ?

thomasten commented 3 years ago

Yes, we plan to add this feature, but don't have an ETA yet.

fnerdman commented 2 years ago

@thomasten Is there an ETA yet for data sealing for hostfs without modifying the application code ?

thomasten commented 2 years ago

@lead4good unfortunately no. It's not being worked on and not scheduled for the near future.