enclave | A simpler way to compile React applications http | Frontend Framework library

I’m working on boost::beast based application on macOS platform, and I wonder how I can provide a client-side certificate to authenticate against the server ?

basically , in macOS the certificates are stored in keychain, and cannot be exported (backed by dedicated hardware called secured-enclave for better security)…

So I wonder if there’s any callback suitable to sign server’s challenge manually with native macOS native code that send the challenge to the keychain/secure-enclave for signing.

basically, I'm looking for a callback that have roughly the following signature :

Good evening, I am building a java project in which it communicates with an Intel SGX Enclave via JNI, and sees information it sends sealed by the enclave.

However, decrypting information returns information I cannot understand, and at this point, I believe it to be due to size differences,but I dont exactly understand it.

So, I know that Sizeof(char*) is equivalent to 1 byte, just like sizeof(jbyte). However, sizeof(jchar) is equivalent to 2 bytes.

After acquiring this knowledge, I decided to implement the Sealing (Or encryption) function by having it take a JByteArray in order to circumvent this problem. Should this byte[] be given in UTF-8 or UTF-16? Does it affect the function overall?

Here is an example of what I do:

I wrote two functions in Objective-C to generate a key pair with method SecKeyCreateRandomKey. In one I use the NSDictionary in another CFMutableDictionaryRef.

The function where I use NSDictionary work perfect on iOS 14 and 15. The code is bellow.

I have a car_data df:

I have an app which generates couple of private keys. When user needs to sign data, they have to authenticate with biometrics and Secure Enclave signs it with the proper private key. Simple.

I got a new requirement - the app needs to be able to sign multiple pieces of data as they arrive in the device and user should authenticate only when signing the first piece.

So my questions are:

1. Is possible to create a private key that stays unlocked for certain amount of time after user authenticates with biometrics? If so, how?

2. Is possible to create a private key that stays unlocked until program tells Secure Enclave to lock it? If so, how?

I searched documentation and stack overflow thoroughly, but without any luck. Any help is much appreciated!

I am working on a project where the data that comes from the customer through a REST API should be encrypted before sending it to the database. To do that, we need to use AWS Nitro Enclave to do the encryption. So Nitro Enclave will receive the data from the parent EC2, talk to KMS to retrieve the encryption key, encrypt the data and send it back to EC2, then EC2 will send it to the database.

The problem is that the data now is exposed in plain text to any one who can access to the EC2 which defeats the whole purpose of securing the data. My question is: Is there anyway that the data will be intercepted by the Enclave itself, in other words, can the TLS terminate in the Enclave? I know that the Enclave does not have any networking capability but I am not sure now how this Enclave solves the issue of securing the personally identifiable information.

Any clarification on this point is much appreciated.

Many thanks! Zak

I am trying to use the Fortanix SGX framework to run libdvdcss in an enclave, but having problems with the linker.

I created a simple FFI wrapper around libdvdcss which works fine when executing it normally on Linux (without SGX and with libdvdcss installed globally). It does not work when I run it with the target x86_64-fortanix-unknown-sgx as specified on the Getting started page, because the linker complains about many missing symbols, especially about malloc etc.

From what I understand, the issue is that there is no libc in SGX, therefore I need to include rs-libc manually, which is basically a libc to use in SGX. The rs-libc crate contains C, ASM and also some Rust code (mostly for malloc). Thus my Cargo.toml:

The Intel official remote attestation sample code, e.g. https://www.intel.com/content/www/us/en/developer/articles/code-sample/software-guard-extensions-remote-attestation-end-to-end-example.html, describe a model that encalve runs in client and server provides secret data, as the below picture shows.

Intel Remote Attestation Model

But I want implement a service that computes user's secret data in enclave. So there are many clients providing secret data and a server running encalve. The obstacle is that the intel sgx sdk doesn't fit this model. For example, function sgx_init_ra declared in sgx_tkey_exchange.h accepts a public key for later verification, and intel's document recommends hard-coding the public key into the enclave code.

The Service Provider's public key should be hardcoded into the enclave. This, combined with enclave signing, ensures that the key cannot be changed by end users so that the enclave can only communicate with the intended remote service.

This fits intel's remote attestation model, but not mine. Becuase in my model, there are many client(secret data provider), and it's difficult to get the client's public key safely.

So, Is there a method to use intel sgx sdk in this model?

I want to immigrate PageRank algorithm in the sgx enclave. The algorithm uses vector to save the edge relationship and matrix.