Can I set the key of encrypted files during application running

[IceCY]

Hi, everyone,

According to the docs, it seems that we should set the key of encrypted files (for specific key_name) before application running. However, my project may need to get the key from the remote during application running.

I am wondering whether it is possible set the key of encrypted files during application running. If it possible, how can I do this?

[dimakuv]

I am wondering whether it is possible set the key of encrypted files during application running. If it possible, how can I do this?

Yes, it is possible. Gramine exposes pseudo-files under /dev/attestation/keys/ directory. See the very last paragraph here: https://gramine.readthedocs.io/en/latest/attestation.html#low-level-dev-attestation-interface

Here is a sample C application that writes/reads these pseudo-files: https://github.com/gramineproject/gramine/blob/master/libos/test/regression/keys.c

Here is another example (our Secret Provisioning library):

gramine/tools/sgx/ra-tls/secret_prov_attest.c

Lines 416 to 446 in a01265b

	char path_buf[256];
	ret = snprintf(path_buf, sizeof(path_buf), "/dev/attestation/keys/%s", key_name);
	if (ret < 0 || (size_t)ret >= sizeof(path_buf)) {
	ERROR("Provisioned key name '%s' is too long\n", key_name);
	exit(1);
	}
	int fd = open(path_buf, O_WRONLY);
	if (fd < 0) {
	ERROR("Secret provisioning cannot open '%s'\n", path_buf);
	exit(1);
	}
	size_t total_written = 0;
	while (total_written < secret_size) {
	ssize_t written = write(fd, secret + total_written, secret_size - total_written);
	if (written > 0) {
	total_written += written;
	} else if (written == 0) {
	/* end of file */
	break;
	} else if (errno == EAGAIN || errno == EINTR) {
	continue;
	} else {
	close(fd);
	ERROR("Secret provisioning cannot write to '%s'\n", path_buf);
	exit(1);
	}
	}
	close(fd); /* applies retrieved encryption key */

I've seen people writing the same on Google Go and Python languages, but unfortunately I cannot find any link to such examples. But it's definitely possible.