% Platform Security: Exercise 5

In this exercise you will use the isolation and sealing features of Intel SGX to protect a signing key.  You will generate a key pair in an SGX enclave, the private part of which will be sealed, that is to say encrypted so that only the same enclave can make use of the key.


Part 1: Setting up the toolchain
--------------------------------

First, set up the environment as follows:
```console
$ . /opt/sgxsdk/environment
```
You can now verify that the SGX tools are available:
```console
$ which sgx_edger8r
/opt/sgxsdk/bin/x64/sgx_edger8r
```

Then, extract the enclave tarball, build it, and run the test application:
```console
$ tar -zxf enclave.tar.gz
$ cd Enclave
$ make
[...]
$ ./test-app
```

Part 2: Generating a key pair
-----------------------------

In the following parts, refer to the [Intel SGX SDK Developer Reference](https://01.org/sites/default/files/documentation/intel_sgx_sdk_developer_reference_for_linux_os_pdf.pdf).

In the file `Enclave_Seal/Enclave_Seal.edl`, you can see the interface defined for the enclave.  For each pointer, an annotation `[in]`, `[out]`, or `[inout]` is used to indicate whether the parameter is used for input or output to the enclave.  When the enclave is built, the SGX SDK will generate interface code that copies data into or out of the enclave according to the direction in the annotation.

This particular enclave has four entry points (known as ECALLs), implemented in `Enclave_Seal/Enclave_Seal.c`:

 - `get_sealed_data_size()` – Returns the size of a sealed private key.
 - `generate_key_pair()` – Generates a key pair, seals the private key so that it can only be decrypted by the same enclave, and returns the public and (sealed) private keys to the application.
 - `sign()` – Sign a block of data using a sealed private key.
 - `verify()` – Verify a signature with a given public key.

First you will implement the `generate_key_pair()` ECALL in `Enclave_Seal/Enclave_Seal.c`.  First, **create a key pair** using the `sgx_ecc256_create_key_pair` library function.  Then, **seal the private key** using `sgx_seal_data`, storing the result in `temp_sealed_buf**.

Part 3: Signing & verifying signatures
--------------------------------------

Next, you will use this key pair for signing.  Because the private key is sealed, it is therefore necessary to make an ECALL into the enclave, which can decrypt the key and perform the signing operation.  Add code to the `sign()` ECALL to **unseal the private key** using `sgx_unseal_data`.  Then, **sign the provided data** using `sgx_ecdsa_sign`.

Similarly, in the `verify()` ECALL, add code to **verify the signature** using `sgx_ecdsa_verify`.  You should now be able to run `test-app`, resulting in the output
```console
$ ./test-app
Verification result: 0
```

Now, in `App/App.c`, **modify the call to `verify()`** so that it attempts to verify the signature for a different string (e.g. by modifying the length provided to `verify()`), and ensure that the verification result changes.