Is there an example or doc of RA-TLS written in Rust?

[ChangoBuitrago]

I'm looking for an example or guidance on how to run a HTTPS API REST server written in Rust within the enclave, with the ability to perform RA-TLS on it.
Thank you.

[dimakuv]

I guess the quick answer is: No, we are not aware of an RA-TLS implementation written in Rust.

Interestingly, the projects that I know of all seem to have C/C++ based implementations of SGX-attested TLS. See the list at https://github.com/CCC-Attestation/interoperable-ra-tls.

Why can't you use e.g. our Gramine RA-TLS libraries and write Rust wrappers around them with FFI?

[ChangoBuitrago]

Hi @dimakuv,
Thank you for the prompt reply, and I hope this finds you well.

I agree with you about FFI. Just FYI, I not only revised your interoperable-ra-tls list but also took the time to review Teaclave (which does have Rust SGX-SDK bindings), Enclaive.io, Mithril Security, Scone, and others.

Presently, popular interoperable languages include Rust, Go, TypeScript, and Python. While Gramine boasts the ability to support them, it lacks examples for RA-TLS in these languages, providing only a C/C++ example.

What concerns me the most is that even if I use FFI or rewrite the entire thing using my preferred language, it would be a waste of time because I don't have a supporting community behind me to review, contribute, and maintain it. Even then, I would have to go through all the years of know-how and hurdles that your team has already overcome.

Looking forward to your thoughts.
Warm regards,

[ChangoBuitrago]

@dimakuv. To make the discussion more tangible, consider the following Gramine Rust example. It's an HTTP rust server running in an enclave. Let's assume I want to RA the enclave before engaging with this server.

https://github.com/gramineproject/gramine/blob/master/CI-Examples/rust/README.md

What are the suggested steps to do the RA using the current proposed C/C++ RA-TLS implementation?
Thank you!

[ChangoBuitrago]

Thank you, @dimakuv. It's all very clear now. Do you have any insights into whether there will be a replacement for the EPID attestation flow?

[kailun-qin]

Do you have any insights into whether there will be a replacement for the EPID attestation flow?

Sorry that I don't quite get this question, but do you mean https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/resources/sgx-ias-using-epid-eol-timeline.html?

[ChangoBuitrago]

Yes, @kailun-qin, thank you. Based on your link and disregarding DCAP, the Intel Trust Authority seems like the EPID replacement. Is this something Gramine supports or will support?

[kailun-qin]

Is this something Gramine supports or will support?

@ChangoBuitrago: Yes, there is an ongoing effort. Pls see gramineproject/contrib#73 and gramineproject/contrib#75 for details.

[ChangoBuitrago]

Thank you for your guidance @kailun-qin. I will definitely delve into it.