Skip to main content

Library to bootstrap WSGI/ASGI application for Gramine

Project description

MicroService Encryption Lib SGX

Overview

MSE lib SGX bootstraps the execution of an encrypted ASGI/WSGI Python web application for Gramine.

The library is responsible for:

  • Configuring the SSL certificates with either:
    • RA-TLS, a self-signed certificate including the Intel SGX quote in an X.509 v3 extension
    • Custom, the private key and full keychain is provided by the application owner
    • No SSL, the secure channel may be managed elsewhere by an SSL proxy
  • Decrypting Python modules encrypted with XSala20-Poly1305 AE
  • Running the ASGI/WSGI Python web application with hypercorn

Technical details

The flow to run an encrypted Python web application is the following:

  1. A first self-signed HTTPS server using RA-TLS is launched waiting to receive a JSON payload with:
    • UUID, a unique application identifier provided to mse-bootstrap as an argument
    • the decryption key of the code
    • Optionally the private key corresponding to the certificate provided to mse-bootstrap (for Custom certificate)
  2. If the UUID and decryption key are the expected one, the configuration server is stopped, the code is decrypted and finally run as a new server

Installation

$ pip install mse-lib-sgx

Usage

$ mse-bootstrap --help
usage: mse-bootstrap [-h] [--host HOST] [--port PORT] [--subject SUBJECT] [--san SAN] --app-dir APP_DIR --id ID [--plaincode]
                     [--timeout TIMEOUT] [--version] [--debug]
                     (--ratls EXPIRATION_DATE | --no-ssl | --certificate CERTIFICATE_PATH)
                     application

Bootstrap ASGI/WSGI Python web application for Gramine

positional arguments:
  application           ASGI application path (as module:app)

optional arguments:
  -h, --help            show this help message and exit
  --host HOST           hostname of the server
  --port PORT           port of the server
  --subject SUBJECT     Subject as RFC 4514 string for the RA-TLS certificate
  --san SAN             Subject Alternative Name in the RA-TLS certificate
  --app-dir APP_DIR     path of the python web application
  --id ID               identifier of the application as UUID in RFC 4122
  --plaincode           unencrypted python web application
  --timeout TIMEOUT     seconds before closing the configuration server
  --version             show program's version number and exit
  --debug               debug mode with more logging
  --ratls EXPIRATION_DATE
                        generate a self-signed certificate for RA-TLS with a specific expiration date (Unix time)
  --no-ssl              use HTTP without SSL
  --certificate CERTIFICATE_PATH
                        custom certificate used for the SSL connection, private key must be sent through the configuration server

Project details


Release history Release notifications | RSS feed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

mse_lib_sgx-2.3.0.tar.gz (15.4 kB view details)

Uploaded Source

Built Distribution

mse_lib_sgx-2.3.0-py3-none-any.whl (15.9 kB view details)

Uploaded Python 3

File details

Details for the file mse_lib_sgx-2.3.0.tar.gz.

File metadata

  • Download URL: mse_lib_sgx-2.3.0.tar.gz
  • Upload date:
  • Size: 15.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/5.1.0 CPython/3.12.4

File hashes

Hashes for mse_lib_sgx-2.3.0.tar.gz
Algorithm Hash digest
SHA256 89403f64f38f712607a37f0ffefbae0c430a78c52c915af5b8b4683a7b64a085
MD5 2be1d0417bc18fdc2d404fa5cfe16fe5
BLAKE2b-256 eb9951971be2de5598c993e0853797d4219c0cda5a95198960216cdc16d6e4f7

See more details on using hashes here.

File details

Details for the file mse_lib_sgx-2.3.0-py3-none-any.whl.

File metadata

  • Download URL: mse_lib_sgx-2.3.0-py3-none-any.whl
  • Upload date:
  • Size: 15.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/5.1.0 CPython/3.12.4

File hashes

Hashes for mse_lib_sgx-2.3.0-py3-none-any.whl
Algorithm Hash digest
SHA256 7621c651a418bd8ff6eccaa647851fe8c773ec55e3b2f6bfb167f078e10f5c90
MD5 12dcabce33cbcb0edcf9398d418336e8
BLAKE2b-256 425161b9a8db6e36c15c564505d2db39218c54970d4eeee97d601677a08ca314

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page