search

oxidecomputer / sprockets

Now's the time on sprockets when we dance
Mozilla Public License 2.0
7 stars 1 forks source link

Use TLS 1.3 and dice-util instead of home-grown protocol #62

Closed andrewjstone closed 2 months ago

andrewjstone commented 5 months ago

This is the start of a major change to sprockets. After much discussion, soul searching, and the reality on the ground after the last couple of years it makes sense to make all sprockets connections run over TLS/TCP, rather than a similar protocol based around the design of TLS 1.3. We choose to use rustls for our TLS implementation, and this PR hooks our verification and signing code into the appropriate rustls traits. By doing this we get a number of things for free that were not part of the sprockets design: session resumption, post-quantum crypto, session key rotation, and most importantly a production ready codebase that is still capable of using our dice verification code, passing signing off to the RoT via IPCC and sprot, and using production attestations before establishing an application-level sprockets connection between sleds.

Sprockets has never actually gone into use for a number of reasons, including that we never wired up proper certs from the RoT, and we didn't have all the low level plumbing via IPCC and sprot completed . We now have RoT certificates and application level verification code in dice-util that is capable of verifying cert chains. We also have a way to generate test-certificates with pki-playground so that we can plug in signing code to rustls before we have the IPCC and sprot paths ready.

This PR implements the relevant rustls traits for signing and verification, along with test-certificates for testing purposes. It uses file based trait impls that will be replaced in production with IPCC and sprot requests. Only configurations for clients and servers are generated along with a thread based test to ensure we can send messages over an established TLS 1.3 connection using these configs. Future PRs will add proper async APIs for creating and accepting sprockets connections, and sending messages. We will not allow establishment of connections or message sending until we have also added in measurement exchange and attestation via dice-util.

andrewjstone commented 2 months ago

@hawkw Thanks for the review! I think I've resolved everything here.