Git Product home page Git Product logo

sgx-wallet's Introduction

sgx-wallet

license

This is a simple password-wallet application based on Intel SGX for linux. Intel also provides a full tutorial and source code for Windows using Visual Studio.

Pre-requisites

Ensure to have the Intel SGX Linux drivers and SDK installed.

Install

Install sgx-wallet as follows:

  • Source the Intel SGX SDK as described here; if your SDK installation path is /opt/intel/sgxsdk/, run:
$ source /opt/intel/sgxsdk/environment
  • Clone and build the source code:
$ git clone https://github.com/asonnino/sgx-wallet.git
$ cd sgx-wallet
$ make

Usage

sgx-wallet comes with a simple cli that can be run with the following options:

  • Show help:
sgx-wallet -h
  • Show version:
sgx-wallet -v
  • Run tests:
sgx-wallet -t
  • Create a new wallet with master-password <master-passowrd>:
sgx-wallet -n master-password
  • Change current master-password to <new-master-password>:
sgx-wallet -p master-password -c new-master-password
  • Add a new item to the wallet with title <item_title>, username <item_username>, and password <item_password>:
sgx-wallet -p master-password -a -x item_title -y item_username -z item_password
  • Remove item at index <item_index> from the wallet:
sgx-wallet -p master-password -r item_index

The wallet data are saved in a file called wallet.seal in the same directory as the main application. Note that you can have only one wallet.seal file, and attempting to call twice sgx-wallet -n master-password will result in an error.

Contribute

Any help is welcome through PRs!

License

The GPLv3 license

sgx-wallet's People

Contributors

asonnino avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

sgx-wallet's Issues

[Security] Authentication bypass

The authentication inside following ECALLs are bypassable using a manipulated OCALL return.
ECALL: ecall_change_master_password(), ecall_show_wallet(), ecall_add_item(), ecall_remove_item()
OCALL: ocall_load_wallet()
Reason:The ECALL accepts the master password. An attacker can bypass the password verification because it is depended on ocall_load_wallet() return (seal data). Using a malicious seal data, an attacker can easily bypass the authentication inside the enclave.

[Security] Double free in ecall_change_master_password() and ecall_add_item()

There is two double-free vulnerability in the enclave code which can lead to an information leak.
ECALLs: ecall_change_master_password() and ecall_add_item()
Code:

    sealed_data = (uint8_t*)malloc(sealed_size);
    sealing_status = seal_wallet(wallet, (sgx_sealed_data_t*)sealed_data, sealed_size);
    free(wallet); // first free
    if (sealing_status != SGX_SUCCESS) {
    	free(wallet);  // second free
        free(sealed_data);
	return ERR_FAIL_SEAL;
    }

Make Error: ocalls.h: No such file or directory

luabolalala@HP:~/Downloads/sgx/sgx-wallet-master$ source /opt/intel/sgxsdk/environment
luabolalala@HP:~/Downloads/sgx/sgx-wallet-master$ make
app/app.cpp:28:10: fatal error: ocalls.h: No such file or directory
 #include "ocalls.h"
          ^~~~~~~~~~
compilation terminated.
Makefile:176: recipe for target 'app/app.o' failed
make: *** [app/app.o] Error 1

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.