You are stuck in a deep, dark wood, with spooky noises and roots that seem to move and trip you up. Behind every tree malevolent eyes look out at you. You look in your backpack and realise that the only tool that you have for your protection is Enarx, the trusty open source project given you by the wizened old person at the beginning of your quest. Hard as you try, you can’t remember what it does, or how to use it. You realise that now is that time to find out.
What do you do next?
- If you are a business person, go to 1. Why I need Enarx to reduce business risk.
- If you are an architect, go to 2. How I can use Enarx to protect sensitive data.
- If you are a techy, go to 3. Tell me more about Enarx technology (I can take it).
1. Why I need Enarx to reduce business risk
You are the wise head upon which your business relies to consider and manage risk. One of the problems that you run into is that you have sensitive data that needs to be protected. Financial data, customer data, legal data, payroll data: it’s all at risk of compromise if it’s not adequately protected. Who can you trust, however? You want to be able to use public clouds, but the risks of keeping and processing information on systems which are not under your direct control are many and difficult to quantify. Even your own systems are vulnerable to outdated patches, insider attacks or compromises: confidentiality is difficult to ensure, but vital to your business.
Enarx is a project which allows you to run applications in the public cloud, on your premises – or wherever else – with significantly reduced and better quantifiable risk. It uses hardware-based security called “Trust Execution Environments” from CPU manufacturers, and cuts out many of the layers that can be compromised. The only components that do need to be trusted are fully open source software, which means that they can be examined and audited by industry experts and your own teams.
Well done: you found out about Enarx. Continue to 6. Well, what’s next?
2. How I can use Enarx to protect sensitive data
You are the expert architect who has to consider the best technologies and approaches for your organisation. You worry about where best to deploy sensitive applications and data, given the number of layers in the stack that may have been compromised, and the number of entities – human and machine – that have the opportunity to peek into or mess with the integrity of your applications. You can’t control the public cloud, nor know exactly what the stack it’s running is, but equally, the resources required to ensure that you can run sufficient numbers of hardened systems on premises are growing.
Enarx is an open source project which uses TEEs (Trusted Execution Environments), to allow you to run applications within “Keeps” on systems that you don’t trust. Enarx manages the creation of these Keeps, providing cryptographic confidence that the Keeps are using valid CPU hardware and then encrypting and provisioning your applications and data to the Keep using one-time cryptographic keys. Your applications run without any of the layers in the stack (e.g. hypervisor, kernel, user-space, middleware) being able to look into the Keep. The Keep’s run-time can accept applications written in many different languages, including Rust, C, C++, C#, Go, Java, Python and Haskell. It allows you to run on TEEs from various CPU manufacturers without having to worry about portability: Enarx manages that for you, along with attestation and deployment.
Well done: you found out about Enarx. Continue to 6. Well, what’s next?
3. Tell me more about Enarx technology (I can take it)
You are a wily developer with technical skills beyond the ken of most of your peers. A quick look at the github pages tells you more: Enarx is an open source project to allow you to deploy and applications within TEEs (Trusted Execution Environments).
- If you’d like to learn about how to use Enarx, proceed to 4. I want to use Enarx.
- If you’d like to learn about contributing to the Enarx project, proceed to 5. I want to contribute to Enarx.
Well done: you found out about Enarx. Continue to 6. Well, what’s next?
4. I want to use Enarx
You learn good news: Enarx is designed to be easy to use!
If you want to run applications that process sensitive data, or which implement sensitive algorithms themselves, Enarx is for you. Enarx is a deployment framework for applications, rather than a development framework. What this means is that you don’t have to write to particular SDKs, or manage the tricky attestation steps required to use TEEs. You write your application in your favourite language, and as long as it has WebAssembly as a compile target, it should run within an Enarx “Keep”. Enarx even manages portability across hardware platforms, so you don’t need to worry about that, either. It’s all open source, so you can look at it yourself, audit it, or even contribute (if you’re interested in that, you might want to proceed to 5. I want to contribute to Enarx).
Well done: you found out about Enarx. Continue to 6. Well, what’s next?
5. I want to contribute to Enarx
Enarx is an open source project (under the Apache 2.0 licence), and we welcome contributions, whether you are a developer, tester, documentation guru or other enthusiastic bod with an interest in providing a way for the rest of the world to up the security level of the applications they’re running with minimal effort. There are various components to Enarx, including attestation, hypervisor work, uni-kernel and WebAssembly run-time pieces. We want to provide a simple and flexible framework to allow developers and operations folks to deploy applications to TEEs on any supported platform without recompilation, having to choose an obscure language or write to a particular SDK. Please have a look around our github site and get in touch if you’re in a position to contribute.
Well done: you found out about Enarx. Continue to 6. Well, what’s next?
6. Well, what’s next?
You now know enough to understand how Enarx can help you: well done! At time of writing, Enarx is still in development, but we’re working hard to make it available to all.
We’ve known for a long time that we need encryption for data at rest and in transit: Enarx helps you do encryption for data in use.
For more information, you may wish to visit:
Alice, Eve and Bob - a security blog 
To my understanding, Enarx builds on a fundamental assumption: we trust the CPU and firmware. In the documentation it is mentioned that both of them are checked cryptographically (hashes). How is this task accomplished exactly?
LikeLike
This is a great question! The exact mechanism depends on the TEE implementation (e.g. Intel SGX is different to AMD SEV) and there are even differences between versions, but yes, they’re checked cryptographically. In fact, there’s more than just a hash: there are one or more signatures on one or more hashes over a set of data (again, what exactly that data is depends on the implementation). We can (and do!) check several things:
1) that the hash is what we expect – i.e. that what’s going/gone into the TEE is what we expect (the Enarx runtime – an empty Keep, if you will);
2) that the signatures are valid;
3) that the signatures were generated by a valid private key.
The last is important: Enarx is working closely with the various hardware providers so that we will be able to check the signatures using the public key associated with the particular hardware.
I hope this is helpful. Do let me know if you have any further questions.
LikeLike