MicroService Encryption Lib SGX
Overview
MSE lib SGX bootstraps the execution of an encrypted ASGI/WSGI Python web application for Gramine.
The library is responsible for:
- Configuring the SSL certificates with either:
- RA-TLS, a self-signed certificate including the Intel SGX quote in an X.509 v3 extension
- Custom, the private key and full keychain is provided by the application owner
- No SSL, the secure channel may be managed elsewhere by an SSL proxy
- Decrypting Python modules encrypted with XSala20-Poly1305 AE
- Running the ASGI/WSGI Python web application with hypercorn
Technical details
The flow to run an encrypted Python web application is the following:
- A first self-signed HTTPS server using RA-TLS is launched waiting to receive a JSON payload with:
- UUID, a unique application identifier provided to
mse-bootstrapas an argument - the decryption key of the code
- Optionally the private key corresponding to the certificate provided to
mse-bootstrap(for Custom certificate)
- UUID, a unique application identifier provided to
- If the UUID and decryption key are the expected one, the configuration server is stopped, the code is decrypted and finally run as a new server
Installation
$ pip install mse-lib-sgx
Usage
$ mse-bootstrap --help
usage: mse-bootstrap [-h] [--host HOST] [--port PORT] [--subject SUBJECT] [--san SAN] --app-dir APP_DIR --id ID [--plaincode]
[--timeout TIMEOUT] [--version] [--debug]
(--ratls EXPIRATION_DATE | --no-ssl | --certificate CERTIFICATE_PATH)
application
Bootstrap ASGI/WSGI Python web application for Gramine
positional arguments:
application ASGI application path (as module:app)
optional arguments:
-h, --help show this help message and exit
--host HOST hostname of the server
--port PORT port of the server
--subject SUBJECT Subject as RFC 4514 string for the RA-TLS certificate
--san SAN Subject Alternative Name in the RA-TLS certificate
--app-dir APP_DIR path of the python web application
--id ID identifier of the application as UUID in RFC 4122
--plaincode unencrypted python web application
--timeout TIMEOUT seconds before closing the configuration server
--version show program's version number and exit
--debug debug mode with more logging
--ratls EXPIRATION_DATE
generate a self-signed certificate for RA-TLS with a specific expiration date (Unix time)
--no-ssl use HTTP without SSL
--certificate CERTIFICATE_PATH
custom certificate used for the SSL connection, private key must be sent through the configuration server
1 maintainer
Metadata
1 maintainer
Release files for mse-lib-sgx 2.3.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| mse_lib_sgx-2.3.0.tar.gz | 15.4 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| mse_lib_sgx-2.3.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 31.2 kB
Release files / mse_lib_sgx-2.3.0.tar.gz
| Download URL | mse_lib_sgx-2.3.0.tar.gz |
|---|---|
| Size | 15.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
89403f64f38f712607a37f0ffefbae0c430a78c52c915af5b8b4683a7b64a085
|
|
BLAKE2b-256 checksum How to use checksums |
eb9951971be2de5598c993e0853797d4219c0cda5a95198960216cdc16d6e4f7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/5.1.0 CPython/3.12.4
|
Release files / mse_lib_sgx-2.3.0-py3-none-any.whl
| Download URL | mse_lib_sgx-2.3.0-py3-none-any.whl |
|---|---|
| Size | 15.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7621c651a418bd8ff6eccaa647851fe8c773ec55e3b2f6bfb167f078e10f5c90
|
|
BLAKE2b-256 checksum How to use checksums |
425161b9a8db6e36c15c564505d2db39218c54970d4eeee97d601677a08ca314
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/5.1.0 CPython/3.12.4
|
Security for mse-lib-sgx 2.3.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
