Send encrypted code

The folder that contains the code of your Secure Computation must be organized like this:

$ tree my_folder
my_folder
├── secret_module.py
└── run.py

If you don’t know how to structure your code, visit Write code.

Before sending your code to the enclave, you need to fetch back the keys generated during the first step. The page Registration explains how to save and load these keys.

Then, upload your code folder, specifying its path. This folder should contains a run.py file which is called the entrypoint. All the files of this folder, except the run.py, will be encrypted.

Python

# send_code.py
from pathlib import Path

from cosmian_secure_computation_client import CodeProviderAPI, CryptoContext

# load the previous CryptoContext created at the registration step
cp_crypto_ctx = CryptoContext.from_json(Path("cp_crypto_context.json").read_text(encoding="utf-8"))
code_provider = CodeProviderAPI(token=cosmian_token, ctx=cp_crypto_ctx)

computation_uuid = "xxxxxxxxxxxxxxxxxxxxxx"
path = Path("my_folder")
code_provider.upload(computation_uuid, path)

Approve the computation as a code provider

Cosmian generates the enclave’s identity asynchronously, you need to wait the end of the generation which takes approximately one minute. This is done after all the participants send their public keys and the code provider sent the Python code.

Python

enclave_public_key: bytes = code_provider.wait_for_enclave_identity(computation_uuid)

The enclave’s identity can be checked from the following elements:

• Intel SGX quote generated by the enclave to attest the code is running in an Intel SGX enclave (can be checked with Azure remote attestation or Intel remote attestation service), it includes:
• MRENCLAVE, a SHA-256 digest of the whole program loaded in memory
• MRSIGNER, a SHA-256 digest of Cosmian’s RSA public key which signs the enclave
• Enclave’s public key (SHA-256 digest can be found in the report data field of the quote)
• TOML manifest with the hash of all the files loaded in the enclave, including:
  • serialized trusted args of the code which contains a list of participant’s public keys
  • hash digest of the entrypoint run.py

Everything should be verified to trust that Cosmian is running the computation inside an Intel SGX enclave:

• Audit source code of cosmian_lib_sgx to see how enclave’s public key is included in the SGX quote. We generate a random key pair whose seed is specific to MRENCLAVE (Seal Key with Intel SGX instruction EGETKEY based on MRENCLAVE). If the Python code or any participant’s key changes, MRENCLAVE will also be modified
• Re-compute MRSIGNER with Cosmian’s RSA public key
• And finally you can re-compute MRENCLAVE with the same docker used in the execution (will be available soon) thanks to manifest and the Python code of the code provider

Python

from cosmian_secure_computation_client.api.remote_attestation import azure_remote_attestation

computation = code_provider.get_computation(computation_uuid)
azure_remote_attestation(computation.enclave.identity.quote)

To approve the computation, send your symmetric key sealed for the enclave’s public key:

Python

code_provider.key_provisioning(computation_uuid, enclave_public_key)