Use the rats-tls for remote attestation

[xwang98]

I would like to share that the WAMR now supports librats (https://github.com/inclavare-containers/inclavare-containers/blob/master/rats-tls/docs/design/design.md) which can greatly simplify the clients doing remote attestation for the wasm runtime and modules running from SGX.

It may have a good chance to be used by the Trusted FaaS of Faasm?

The sample is available here:
https://github.com/bytecodealliance/wasm-micro-runtime/blob/main/samples/sgx-ra/README.md

[csegarragonz]

Hi, thanks for pointing this out!

Let me make sure I understand what is going on in the example. It seems to me that librats is callled from inside WASM code. What is the purpose of calling librats_verify from inside the enclave?

I would expect a remote party to be the one interested in verifying the quote. Also, what attestation service does librats use to validate the quote?

[zeuson0]

Hi, thanks for pointing this out!

Let me make sure I understand what is going on in the example. It seems to me that librats is callled from inside WASM code. What is the purpose of calling librats_verify from inside the enclave?

I would expect a remote party to be the one interested in verifying the quote. Also, what attestation service does librats use to validate the quote?

Hi, I'm one of the contributors to librats and ported it for WAMR. It could help users of faasm to verify that the runtime is trusted and the module run in it is untampered. Also, it supports mutual authentication between different runtimes in different TEEs.

Librats is called from inside WASM code because we think that users may needs to implement a network service in the WASM module and decide when and how to do remote attestation, but it's not applicable to faasm obviously. We suggest that we could implement an attestation agent in the WASM launcher like iwasm. We would implement it if faasm use iwasm as the WASM launcher directly. If not, you could called APIs of librats by linking the libraries of WAMR into faasm's launcher.

The purpose of calling librats_verify from inside the enclave is that we hope both the attestation and verification are trusted, it could be ensured by the measurement of enclave.

Librats validate the quote locally and collect endorsements from the PCCS. And it supports emscripten so it could be validated in the browser if you want.