Core modules

The SDK includes the following two core modules:

• TrustRoot

• KeyStore

TrustRoot

TrustRoot is the SDK's core validation module. It authenticates the identity and computing behavior of trusted computing applications. During initialization, trust root information from the configuration is injected into this module.

The trust root information includes the Intel Attestation Service (IAS) root certificate IASCACert, the enclave code measurement MrEnclave, and the enclave code issuer's public key measurement MrSigner. This information is injected when you first initialize the client. You can set the trust level TrustLevel to select the validation level as needed.

• If the trust level is 0, the MYTF identity is not verified.

• If the trust level is 1, MrSigner is verified. This authenticates that the MYTF is a trusted compute engine issued by Ant Blockchain.

• If the trust level is 2, MrEnclave is verified. This authenticates the code measurement of the MYTF enclave.

Authenticating an MYTF involves verifying its remote attestation report from the Intel Attestation Service (IAS). The Remote Attestation flow verifies that the MYTF is the correct trusted execution code and generates an Attestation Verification Report (AVR). The report includes information about the MYTF code and its hardware. During initialization, the SDK automatically fetches the MYTF's AVR and authenticates the MYTF.

• Example

// The following scenario involves three parties. A third-party service platform provides users with a privacy-preserving trusted computing service. The business logic is written as a TAPP and installed on the C3S platform.
// After installing the TAPP, the third-party service platform obtains MYTFInfo and TAPPInfo.
 MYTFInfo mytfInfo = restClient.getMYTFInfo();
 TappInfo tappInfo = restClient.getTappInfo(tappId, tappVersion);

 // The third-party service platform extracts the proof from MYTFInfo and TAPPInfo and provides it to its users.
 String providedMYTFProfile = mytfInfo.getMytfProfile();
 String providedTAPPProfile = tappInfo.getTappProfile();

// The user of the third-party service platform locally sets the trust root and validation method.
TrustRoot userTrustRoot = new TrustRoot(1, IAS_CA_CERT, MYTF_MRSIGNER, MYTF_MRENCLAVE);

// The user verifies the MYTFProfile provided by the service platform and checks if MYTFInfo is correct to ensure the platform is using the correct C3S service.
Assert.assertTrue(userTrustRoot.loadMYTFInfo(providedMYTFProfile));

// The user verifies the TAPPProfile provided by the service platform and checks if tappInfo is correct to ensure the platform is using the correct TAPP.
TappInfo tappInfo1 = userTrustRoot.getTappInfo(providedTAPPProfile);

KeyStore

KeyStore is the SDK's key management module. It manages keys required for trusted computing and provides interfaces for encryption, decryption, signing, and signature verification. When you initialize the configuration, key information is injected into this module.

• Example

// Get the KeyStore from the client.
KeyStore keyStore = restClient.getKeyStore();

// Get the user keys.
UserKeyPair userAccessKeyPair = restClient.getKeyStore().getAccessKeypair();
UserKeyPair userIdentityKeyPair = restClient.getKeyStore().getIdentityKeypair();
UserKeyPair userSecretKeyPair = restClient.getKeyStore().getSecretKeypair();

// Use the user's private key to construct and open a tappEnvelope.
String plainData = "this is test for envelopeOpen & envelopeBuild";
byte[] tappEnvelope = restClient.getKeyStore().buildTappEnvelope(tappInfo, plainData.getBytes());
byte[] envelopeRecoverPlainData = restClient.getKeyStore().openTappEnvelope(tappInfo, tappEnvelope);

// Use the user's access key to perform RSA signing and signature verification.
String plainData2 = "this is test for RSASign & RSAVerify";
byte[] sig = restClient.getKeyStore().accessKeySign(plainData2.getBytes());
Assert.assertTrue(restClient.getKeyStore().accessKeyVerify(plainData2.getBytes(), sig));