TaLoS: Efficient TLS Termination Inside SGX Enclaves for Existing Applications

TaLoS¹ is a TLS library that allows existing applications (with an OpenSSL/LibreSSL interface) to securely terminate their TLS connection. For this, TaLoS places security-sensistive code and data of the TLS library inside an Intel SGX enclave, while the rest of the application remains outside. It can then be used as the building block for a wide range of security-critical applications for which the integrity and/or confidentiality of TLS connections must be guaranteed. TaLoS offers the developper a simple interface to process TLS communications securely. For example, this interface can be used to securely send the HTTPS requests and responses to another enclave or to encrypt them before logging them to persistent storage. TaLoS provides good performance by executing enclave transitions asynchronously and leveraging user-level threading inside the enclave.

The code is accompanied with a technical report, containing details about the architecture and performance results.

In contrast to the SSL add-on for the Intel SGX SDK, TaLoS exposes the OpenSSL/LibreSSL API to untrusted code outside of the enclave. This means that existing applications can use the TaLoS library with no or only minor modifications. The Intel SGX SDK SSL add-on does not expose an outside interface, which means that applications must be modified to use it.

The current implementation of TaLoS utilises libreSSL v2.4.1 and has been tested with the following applications under Linux:

• Apache web server (v2.4.23);

• Nginx web server (v1.11.0);

• Squid proxy (v3.5.23).

Quick set-up using Docker

We provide a Dockerfile that is configured to run Apache with TaLoS and the SGX simulator. The Dockerfile can be found in the root folder of this repository. To use it:

• Clone the repository

• Build the TaLoS Docker image by running docker build -t talos . from within the root directory of the repository

• Run Apache with TaLoS by running the Docker image: docker run -dt -p 7778:7778 talos /start.sh

• Verify that Apache is running: wget --no-check-certificate https://localhost:7778/index.html

Manual Installation

Follow these instructions to build the TaLoS library and the sample applications. We assume that the path to the repository is ${PROJECT_ROOT} (eg /home/<username>/talos/).

Compiling the TaLoS Library

The source code specific to TaLoS can be found in ${PROJECT_ROOT}/src/talos while the original code of libreSSL is in ${PROJECT_ROOT}/src/libressl-2.4.1.

To patch libreSSL, you need to execute:

$ cd ${PROJECT_ROOT}/src/talos
$ ./patch_libressl.sh

To compile TaLos, go to the ${PROJECT_ROOT}/src/libressl-2.4.1/crypto directory and edit the enclaveshim_config.h file. In particular, you need to undefine COMPILE_OPTIMISATION_FOR_APACHE when compiling TaLoS for Squid or Nginx. Afer that, execute one of the following lines:

$ make -f Makefile.nosgx # no SGX
$ make -f Makefile.sgx   # SGX, simulator mode
$ SGX_PRERELEASE=1 SGX_MODE=HW make -f Makefile.sgx # SGX, real hardware mode

This creates three files:

• libenclave.so and libenclave.a are the untrusted libraries that link against the application. The Makefile generates both a static and shared versions, but you should use only one of them, depending on your application.

• The trusted library, which executes inside an SGX enclave, is enclave.signed.so. The code expects this library to be present in the current directory when launching the application. The easiest way to ensure this is to create a symbolic link, as shown in the next sections.

Finally, several symbolic links to the untrusted TaLoS library file have to be created in ${PROJECT_ROOT}/src/libressl-2.4.1/lib :

make -f Makefile.nosgx install # without SGX
make -f Makefile.sgx install # with SGX, simulator or hardware mode

Note that, since the SGX SDK v2.0, the SDK libraries make calls to OpenSSL in simulation mode to emulate cryptographic functions that would normally happen inside the enclave. However, as TaLoS replaces OpenSSL this creates a conflict (see issue #12). TaLoS, when created in simulation mode, separately loads the system OpenSSL library. The path is defined by the OPENSSL_LIBRARY_PATH macro in enclaveshim_config.h.

Using TaLoS with Nginx

First, download Nginx v1.11.0:

wget http://nginx.org/download/nginx-1.11.0.tar.gz

We assume that you have downloaded and extracted Nginx to ${PROJECT_ROOT}/src/nginx-1.11.0. You can then to run configure:

./configure --prefix=${PROJECT_ROOT}/src/nginx-1.11.0/install --with-http_ssl_module --with-openssl=${PROJECT_ROOT}/src/libressl-2.4.1/

You then need to edit objs/Makefile:

1. check that the path for the include directory of libressl is correct in ALL_INCS and CORE_INCS;

2. remove the include/openssl/ssh.h line in CORE_DEPS and the include/openssl/ssh.h rule (we have already compiled libressl);

3. in objs/nginx, for the LINK phase, update the following line with the correct path to libssl.a and libcrypto.a and add -lsgx_urts -lsgx_uae_service. Depending on how you compiled TaLoS, you may want to change -lsgx_urts -lsgx_uae_service (real hardware) to -lsgx_urts_sim -lsgx_uae_service_sim (simulator).

The code is ready to be compiled:

$ make
$ make install

Before starting the server, you need to copy the Nginx configuration from ${PROJECT_ROOT}/conf/nginx/ to install/conf, create your own TLS certificate and associated keys, and change the paths in install/conf/nginx.conf to reflect the location where you cloned TaLoS:

$ cp ${PROJECT_ROOT}/conf/nginx/* install/conf/
$ sed -i 's#/home/talos/talos#${PROJECT_ROOT}#' install/conf/nginx.conf
$ echo "\nABC\nMy City\nMy Institution\n\nwww.example.com\n\n" | openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ${PROJECT_ROOT}/src/nginx-1.11.0/install/conf/cert.key -out ${PROJECT_ROOT}/src/nginx-1.11.0/install/conf/cert.crt
$ ln -s ../libressl-2.4.1/crypto/enclave.signed.so

To start Nginx (LD_LIBRARY_PATH is needed only if you use the TaLoS shared library):

$ LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:$(pwd)/../libressl-2.4.1/lib ./objs/nginx

You should be able to access the web pages with:

$ wget --no-check-certificate https://localhost:7778/index.html

Using TaLoS with Apache

First, download Apache v2.4.23:

wget http://archive.apache.org/dist/httpd/httpd-2.4.23.tar.bz2

We assume that you have extracted Apache to ${PROJECT_ROOT}/src/httpd-2.4.23. You can now configure it:

$ ./configure --prefix=${PROJECT_ROOT}/src/httpd-2.4.23/install --enable-http --enable-proxy --enable-ssl --enable-ssl-staticlib-deps --with-ssl=${PROJECT_ROOT}/src/libressl-2.4.1 --enable-file-cache --enable-cache --enable-disk-cache --enable-mem-cache --enable-deflate --enable-expires --enable-headers --enable-usertrack --enable-cgi --enable-vhost-alias --enable-rewrite --enable-so --with-mpm=worker

You then need to update modules/ssl/modules.mk as follows (you may want to change -lsgx_urts -lsgx_uae_service to -lsgx_urts_sim -lsgx_uae_service_sim to use the SGX simulator; note that you need to expand the ${PROJECT_ROOT} variable in this file):

MOD_CFLAGS = -I${PROJECT_ROOT}/src/libressl-2.4.1/include
MOD_LDFLAGS = -L${PROJECT_ROOT}/src/libressl-2.4.1/lib -lssl -lcrypto -ldl -luuid -lrt -lcrypt -lpthread -lsgx_urts -lsgx_uae_service

To work properly with TaLoS, Apache requires the COMPILE_OPTIMISATION_FOR_APACHE macro in enclaveshim_config.h to be defined. If this is not the case, then you will first need to define it and compile TaLoS again.

Apache is now ready to be compiled and installed:

$ make
$ make install

The configuration to use Apache with HTTPS can be found in ${PROJECT_ROOT}/conf/apache/. You need to copy the content of this directory to install/conf/ and edit it to reflect your configuration. You may want to change the user and group to run httpd as well as the /talos path. You also need to create your own TLS certificate and associated keys:

$ echo "\nABC\nMy City\nMy Institution\n\nwww.example.com\n\n" | openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ${PROJECT_ROOT}/src/httpd-2.4.23/install/conf/cert.key -out ${PROJECT_ROOT}/src/httpd-2.4.23/install/conf/cert.crt
$ ln -s ../libressl-2.4.1/crypto/enclave.signed.so

Before starting Apache, you need to create the following symbolic links:

$ ln -s ../libressl-2.4.1/crypto/enclave.signed.so
$ ln -s ../../../libressl-2.4.1/lib/libssl.so install/lib/libssl.so
$ ln -s ../../../libressl-2.4.1/lib/libcrypto.so install/lib/libcrypto.so

Finally, you can use the following command to start Apache:

$ ./install/bin/httpd -X #-> only 1 process, no fork

You can access web pages with:

$ wget --no-check-certificate https://localhost:7778/index.html

Note that, by default, TaLoS is compiled for 50 concurrent threads inside the enclave (see TCSNum in enclave.config.xml) while Apache might use hundreds of threads (see the worker module options in http-2.4.23/install/config/extra/http-mpm.conf). You might want to make these numbers consistent.

Using TaLoS with Squid

First, download Squid v3.5.23:

wget http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.23.tar.gz

We assume that you have downloaded and extracted the code to ${PROJECT_ROOT}/src/squid-3.5.23. You first need to configure it:

$ ./config