Sign inSign up

switchboardlabs/secrets-server

By switchboardlabs

•Updated almost 2 years ago

Allows secure enclaves to gossip secrets to other enclaves based on their MrEnclave values.

Image
0

2.4K

switchboardlabs/secrets-server repository overview

⁠

⁠Switchboard Secrets Server

A gossip server within a secure enclave allowing a secret owner to gossip their secrets to other secure enclaves based on the secret owners config.

Discord ⁠ Twitter ⁠

⁠Environment Variables

VariableDefinition
CONFIGSRequired

JSON stringified object containing an array of permitted mrEnclaves that can access this secret and a set of permitted advisories for ensuring enclaves are kept up to date.

Sample env.CONFIGS

{
  "mrEnclaves": [
    "44239ca94f74fe51e2da682f8d3c50f27cc36588f1270c670472032770ca3ef0"
  ],
  "permittedAdvisories": [
    "INTEL-SA-00615" /* Gramine mitigated: https://github.com/gramineproject/gramine/pull/1237 */
  ],
  "keys": {
    "POLYGON_API_KEY": "XYZ",
    "INFURA_API_KEY": "XYZ"
  }
}
  • mrEnclaves: This denotes which functions may access your data. The keys in the api server will be inaccessible to anyone who does not generate a valid quote with any of the listed measurements
  • permittedAdvisories: If the oracle produces a quote on a chip with any active advisories, they will be listed in the attested quote. Some of these advisories have code mitigations built into the gramine runtime, like the one listed in the example
  • keys: A hashmap of all the confidential values that you would like to make available to your function

⁠Usage

Once you have a secrets server setup, you may now access your secrets within your Switchboard Function like so:

let secrets = fetch_secrets("http://${SECRETS_SERVER_IP}:8080").await;

⁠Azure Deployment

The secrets server needs to run within a secure enclave. Currently only Microsoft Azure is supported in the docs.

Install the Azure CLI. See the Official Docs - How to install Azure CLI⁠.

# Ubuntu
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Mac OS
brew update && brew install azure-cli

Login

az login

Run the following to create a cluster named switchboard-secrets in uksouth, enable the confidential compute plugin, create a static IP address and assign it to the cluster.

az group create --name Default --location uksouth

az aks create --name switchboard-secrets \
    --resource-group Default \
    --node-vm-size Standard_DC2s_v3 \
    --generate-ssh-keys

az aks enable-addons --addons confcom --name switchboard-secrets --resource-group Default

az network public-ip create --name secrets-ip --sku Standard \
  --allocation-method Static \
  --resource-group $(az aks show --resource-group Default --name switchboard-secrets --query nodeResourceGroup -o tsv)

az aks update --name switchboard-secrets \
    --resource-group Default \
    --load-balancer-managed-outbound-ip-count 0 \
    --load-balancer-outbound-ips $(az network public-ip show --name secrets-ip --resource-group Default --query id --output tsv)

Tag summary

Content type

Image

Digest

sha256:57fc1d7ff…

Size

306.4 MB

Last updated

almost 2 years ago

docker pull switchboardlabs/secrets-server:dev-RC_24_11_14_22_53