Hi, First off all thank you for the excellent workshop. It really helped me understand the attestation process trough KMS

One remark
When trying to decrypt plaintext information through the enclave.
the enclave crashes with the following message.

Traceback (most recent call last): File "/app/server.py", line 87, in <module> main() File "/app/server.py", line 73, in main plaintext = get_plaintext(credentials) File "/app/server.py", line 23, in get_plaintext creds = decrypt_cipher(access, secret, token, ciphertext, region) File "/app/server.py", line 51, in decrypt_cipher plaintext = json.loads(base64.b64decode(b64text)) File "/usr/lib64/python3.7/json/__init__.py", line 348, in loads return _default_decoder.decode(s) File "/usr/lib64/python3.7/json/decoder.py", line 340, in decode raise JSONDecodeError("Extra data", s, end) json.decoder.JSONDecodeError: Extra data: line 1 column 5 (char 4) child exited with error

As far as I know, this is because of line 52 in the server.py script. I don't really understand why the json.loads(plaintext) is necessary there so I just replaced it with plaintext.decode() and it works fine now.

I followed the instruction as described in the secure local channel. But server application reside in the enclave environment always get TLS issue of tls:protocol not supported.

Step 46/51 : RUN cmake3 --build aws-nitro-enclaves-sdk-c/build --target install
---> Running in 9650115a1d96
[1/19] Building C object CMakeFiles/aws-nitro-enclaves-sdk-c.dir/source/cms.c.o
FAILED: CMakeFiles/aws-nitro-enclaves-sdk-c.dir/source/cms.c.o
/usr/bin/cc -DAWS_USE_EPOLL -DDEBUG_BUILD -DHAVE_SYSCONF -DUSE_VSOCK -I../include -Wall -Werror -Wstrict-prototypes -Wextra -pedantic -Wno-long-long -fPIC -pthread -D_ADX_ -DS2N_HAVE_EXECINFO -std=gnu99 -MD -MT CMakeFiles/aws-nitro-enclaves-sdk-c.dir/source/cms.c.o -MF CMakeFiles/aws-nitro-enclaves-sdk-c.dir/source/cms.c.o.d -o CMakeFiles/aws-nitro-enclaves-sdk-c.dir/source/cms.c.o -c ../source/cms.c
../source/cms.c: In function 'aws_cms_parse_enveloped_data':
../source/cms.c:67:10: error: too many arguments to function 'CBS_get_any_ber_asn1_element'
if (!CBS_get_any_ber_asn1_element(&cms, NULL, &tag, &tag_size, NULL) || /* ASN1_SEQ */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../source/cms.c:10:0:
/usr/include/openssl/bytestring.h:258:20: note: declared here
OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS out,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../source/cms.c:78:10: error: too many arguments to function 'CBS_get_any_ber_asn1_element'
if (!CBS_get_any_ber_asn1_element(&cms, NULL, &tag, &tag_size, NULL) || / ASN1_ENUM */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../source/cms.c:10:0:
/usr/include/openssl/bytestring.h:258:20: note: declared here
OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS out,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../source/cms.c:79:10: error: too many arguments to function 'CBS_get_any_ber_asn1_element'
!CBS_get_any_ber_asn1_element(&cms, NULL, &tag, &tag_size, NULL) || (tag != CBS_ASN1_SEQUENCE) || / ASN1_SEQ */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../source/cms.c:10:0:
/usr/include/openssl/bytestring.h:258:20: note: declared here
OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS *out,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../source/cms.c:92:10: error: too many arguments to function 'CBS_get_any_ber_asn1_element'
if (!CBS_get_any_ber_asn1_element(&cms, &enveloped_data, &tag, &tag_size, NULL) || tag != CBS_ASN1_SET) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../source/cms.c:10:0:
/usr/include/openssl/bytestring.h:258:20: note: declared here
OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS *out,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../source/cms.c:140:10: error: too many arguments to function 'CBS_get_any_ber_asn1_element'
if (!CBS_get_any_ber_asn1_element(&cms, NULL, &tag, &tag_size, NULL) || (tag != CBS_ASN1_SEQUENCE) ||
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../source/cms.c:10:0:
/usr/include/openssl/bytestring.h:258:20: note: declared here
OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS *out,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../source/cms.c:154:10: error: too many arguments to function 'CBS_get_any_ber_asn1_element'
if (!CBS_get_any_ber_asn1_element(&cms, &content_encryption_algo, &tag, &tag_size, NULL) ||
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../source/cms.c:10:0:
/usr/include/openssl/bytestring.h:258:20: note: declared here
OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS out,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../source/cms.c:177:10: error: too many arguments to function 'CBS_get_any_ber_asn1_element'
if (!CBS_get_any_ber_asn1_element(&cms, NULL, &tag, &tag_size, NULL)) { / ASN1_ENUM */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../source/cms.c:10:0:
/usr/include/openssl/bytestring.h:258:20: note: declared here
OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS *out,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../source/cms.c:189:12: error: too many arguments to function 'CBS_get_any_ber_asn1_element'
while (CBS_get_any_ber_asn1_element(&cms, &wrapped_encrypted_content, &tag, &tag_size, NULL) == 1 &&
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../source/cms.c:10:0:
/usr/include/openssl/bytestring.h:258:20: note: declared here
OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS *out,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
[2/19] Building C object CMakeFiles/aws-nitro-enclaves-sdk-c.dir/source/attestation.c.o
[3/19] Building C object CMakeFiles/aws-nitro-enclaves-sdk-c.dir/source/kms.c.o
ninja: build stopped: subcommand failed.
The command '/bin/sh -c cmake3 --build aws-nitro-enclaves-sdk-c/build --target install' returned a non-zero code: 1

I suggest updating this Dockerfile based on https://github.com/aws/aws-nitro-enclaves-sdk-c/blob/main/containers/Dockerfile.al2

Following this:

https://nitro-enclaves.workshop.aws/en/my-first-enclave/cryptographic-attestation.html

The encrypted text could not be decrypted with error.

{
    "error": "KMS Error. Decryption Failed."
}

The ciphertext was printed on screen. When I copy it down, base64 decode it into binary, then with AWS CLI I could decrypt it okay.

I thought it was the encoding, but when I decode string.encrypted into string.encrypted.binary and use it as argument, client.py complains about unable to read it with utf-8 encoding.

I can see that the string is read and passed into enclave with no modification. KMS SDK seems to accept ciphertext directly without the binary conversion.

I'm not sure what went wrong. Please advise. Thanks!

Hi! I'm trying to understand how to request the attestation document inside the enclave using python (specifically, with the user_data field populated with a custom string generated inside the enlcave). Could you please help me with this?