How to perform local attestation between two graphene apps?

[sammyne]

Description of the problem

I'm running two graphene apps in the same SGX machine, and wondering if there is any doc or example of how to perform local attestation between apps.

Remote attestation isn't what I want.

Steps to reproduce

Expected results

Actual results

[mkow]

We don't support this, but why would you do this? What are you trying to do? Why not just run both of these apps in a single Graphene instance?

[sammyne]

We don't support this, but why would you do this? What are you trying to do? Why not just run both of these apps in a single Graphene instance?

In my case, there is a QE-like enclave X authenticating local enclaves by means of issuing signed tokens for any locally attested enclaves. X is a centralized service with constant quote (periodically refreshed) such that users just needs to check the quote of X and its signed token to authenticate enclaves on the same platform. @mkow

[dimakuv]

@sammyne Graphene supports local attestation flows, but this is not described clearly in the documentation (for the reason that it is not really needed by normal users).

However, you can find hints to implement local attestation:

• https://graphene.readthedocs.io/en/latest/attestation.html#low-level-dev-attestation-interface
• https://github.com/oscarlab/graphene/blob/c321726229eaf0a1b52dc5e2507c9cfab423ea94/LibOS/shim/test/regression/attestation.c#L184 -- example code
• https://github.com/oscarlab/graphene/blob/master/LibOS/shim/src/fs/dev/attestation.c -- actual C implementation, see the comments

[mkow]

Oh, I really forgot that we actually support this... :)

[sammyne]

• graphene/LibOS/shim/test/regression/attestation.c

Great thanks. It would be better if the document can explicitly describe the usable but undocumented /dev/attestation/target_info and /dev/attestation/my_target_info. @dimakuv @mkow

[mkow]

Yeah, I agree that we should document it.