As explained in the last chapter, we have to define two different calls to be able to interact with the enclave:
Ecalls and Ocalls work differently. We will not go into too much detail explaining how (at least for now), but it is best practice to keep the amount of Ocalls as low and as controlled as possible. A misuse of an external function on a Ocall can leak or write enclave data if not properly implemented.
To implement the Ecall and Ocall, we'll need to define them in a Enclave Definition Langage (EDL) file.
Then we'll pass this EDL file to a tool called edger8r. We'll use it to generate proxy files, which will handle interactions between the host and the enclave.
We define the Ecall and Ocall functions the same way we write prototypes in header files in C/C++.
The general skeleton of an EDL file resembles the following:
Let's get coding!
To communicate with our KMS, we first need to have a user interface or a programming interface (API). To do so, we'll implement a self-signed HTTPS server running inside the enclave. We'll define multiple endpoints which will be necessary for interacting with our KMS.
In this chapter, we'll start by coding a simplified version of it, which will be unsafe. But as we go through the chapters of the course, we'll improve that code to make it more robust against attacks - all the way until we it is ready for a realistic scenario!
To communicate data safely through HTTP, you need an encryption layer such as the Transport Layer Security or TLS. When you combine them, HTTP becomes HTTPS because the TLS ensures that the communication between two peers is secured.
The three main properties of TLS are:
One of the way to implement these properties is by using a Public Key Infrastructure X.509 (PKIX).
The PKI certificate mechanism allows clients to verify the server's identity, and the certificate is based on the X.509 format, which is a standard for representing public key certificates.
To set up the HTTPS server and run it, we'll implement an Enclave Call (Ecall)!
Our HTTPS server is self-signed, which means that we will have to pass two arguments to the Ecall:
Create a kms.edl file and copy/paste, write in the following code block:
The first lines import different EDL files:
Next comes the trusted section, where we write our Ecall:
We define the Ecall as set_up_server with the four arguments we detailled earlier :
The boundary is in because we only need to read the argument.
It's now time to use the edger8r tool to generate the proxy files! They'll be the way to communicate back and forth between the enclave and the host.
To generate those files we can run the following commands. You can try them for demonstration and exploration purposes - but as you'll see in the next chapter, you won't have to type in those commands manually because they'll be in a Makefile.
In this tutorial, we'll call the proxy files generated by those commands using the following names:
Those proxy files define all the imported Ecall and Ocall, as well as those that we'll write in the EDL file.
In the next chapter, we will begin to write the HTTPS server and our KMS. We'll also launch our first enclave!
