Is it possible to get DCAP quote collateral?

[jasl]

I need to eager prepare quote collateral for verify the quote on non-sgx environment

[kailun-qin]

Yes, it's possible via DCAP qpl public APIs (out of Gramine's scope), e.g., sgx_ql_get_quote_verification_collateral(). Please kindly refer to https://download.01.org/intel-sgx/latest/dcap-latest/linux/docs/Intel_SGX_ECDSA_QuoteLibReference_DCAP_API.pdf pg.20 for further details, thanks!

[dimakuv]

@jasl Are you looking for a way to do it in Gramine specifically? As @kailun-qin mentioned, it is not possible in current Gramine.

But if you have a real usage for this feature, we could implement a pseudo-file /dev/attestation/quote-collateral that would contain this. Though I'm not sure if this is that useful on its own really...

[jasl]

@dimakuv @kailun-qin
I just make a quick chat with Intel SDK team, they give me a possible solution:

• I need modify QVE to expose tee_get_fmspc_ca_from_quote
• I need link QPL and QVE with my Gramine app
• I can use tee_get_fmspc_ca_from_quoteand tee_get_verification_endorsement to get collateral

I haven't try yet, what do you think?

[jasl]

@dimakuv @kailun-qin

I'm from https://github.com/Phala-Network/phala-blockchain team, our goal is providing a serverless-like distributed computing network.
We are using SGX to secure computing node which based on Gramine, called PRuntime
and we're using blockchain as control plane to mange computing nodes' lifecyle (register, start, stop, remove, healthy check, etc.), and tasks distribution.

We're using Remote Attestation to generate quote from computing node, and verify it on blockchain to ensure the node is a valid SGX enclave,
currently we supported EPID, now I'm working on DCAP.
The blockchain is Substrate-based which provides a WASM environment so it's an untrusted environment and no external IO, so we have to prepare everything before do the verification.

here's an example that how we verify EPID report https://github.com/Phala-Network/phala-blockchain/blob/master/pallets/phala/src/registry.rs#L405-L483

[jasl]

@dimakuv @kailun-qin I just make a quick chat with Intel SDK team, they give me a possible solution:

• I need modify QVE to expose tee_get_fmspc_ca_from_quote
• I need link QPL and QVE with my Gramine app
• I can use tee_get_fmspc_ca_from_quoteand tee_get_verification_endorsement to get collateral

I haven't try yet, what do you think?

As I said in the sync meeting, this workaround works in theory, and it's you app's logic, which doesn't depend on Gramine. But note that the workaround is a little tricky, you should only treat it as an backup option. In addition, we will add additional API in DCAP QVL to help user retrieving collaterals in later release.

Great! thanks, for the timing I'll try workaround first, and will migrate to new official release

BTW, is there ETA for the new release? in September maybe?

[mkow]

BTW, is there ETA for the new release? in September maybe?

Likely in around 2 weeks.

[dimakuv]

@mkow is talking about the upcoming release of Gramine -- it is likely in around 2 weeks (end of August).

We don't know about the new release of Intel SGX DCAP libraries though. @hyjiang should answer this question.

[mkow]

Oops, right, I was only skimming through the discussion and noticed someone asking about the release, so I quickly replied missing the context. Sorry :)