# Ledger SGX enclave - (un)popularity assessment and the way forward by Nicolas Bacca (Devcon4)

- Speakers: [Nicolas Bacca](https://streameth.org/speakers/nicolas-bacca)
- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2019-10-09
- Duration: 18:31
- Topics: blockchain, smart contracts, distributed ledger, Science & Technology
- Watch: https://streameth.org/watch/yt-0W6pqQhcs6E
- YouTube: https://www.youtube.com/watch?v=0W6pqQhcs6E

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/4/ledger-sgx-enclave-unpopularity-assessment-and-the-way-forward

An overview of the new developer features available for Ledger Nano S Ethereum application, including the validation of an arbitrary smart contract call on screen and how to design a Dapplet on a Nano S to assist the security of Dapps. 

Speaker(s): Nicolas Bacca
Skill level: Expert
Track: Security
Keywords: dapps, dapplet

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 4 was held in Prague, Czech Republic on Oct 30 - Nov 2, 2018.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

hi everybody so maybe you are not coming for this talk so I have an explanation for that which is right there so where I can try to convince that this is the talk you were coming from you are coming from but it will probably not work so my initial talk was rejected and I got a notification like yesterday at midnight that in fact it was not rejected so I decided to recycle some slides I had for hgx add a bit more content and that's what the talk will be about so if you have a medical condition and you can't listen to a nice Jake's talk you might leave I won't be offended otherwise it should be interesting so with that we are going to talk so a little bit more about around clave the idea is to keep talking about what we did last year previously which was not very successful we will discuss why and we will discuss how we can improve that and well if you want to follow something for example during the talk and read something during the talks a thread model we have in the readme is interesting to read and it's still up to date even if the code is not so first question you can ask why are we making a month wave as a hardware wallet manufacturer so the first thing is that we are lecture has been developing into civil industries and created several business units today so we are not only making our wallets with the SE on which we can call our own OS we are exploring the custodian model where we work on HSN that are not built by us so in that case we need to work into something that looks a little bit like an enclave and we want to transition from a company manufacturing hardware devices to a company selling operating system licenses and for that enclaves are very good target because he already exists there already in the market and the main obstacle today for people to use a ledger is actually to buy a ledger so if we could find a way to download a ledger and have an interesting security on an existing computer it would be quite interesting for us and so that's why we are digging into those models and we are rating the security very thoughtfully for that so we have a reusable operating system code base working on Clavin changing from a secure element to an enclave first is quite easy so using this way using expenses and another important thing is that well we have a strong expertise in hardening cryptographic code and this is some things that's difficult to do I mean that some things that you don't usually do because a lot of people using secure elements will just reuse a vendor cryptographic library we build them from scratch and we use everything that we have on the chip to make them harder so we did a popular CTF this year honourable device that was worn by a company called ninja labs they like CTF didn't describe everything yet but it is related to side channels and to template profiling on side channels so that's the kind of things we want to do an edge takes as well improve it and provide the result you everybody so if you want to transition from a hardware wallet to via to a secure device so 12 Enclave you have to consider a few things first you want to focus on the key protection so keyboard action is the most important part of a hardware wallet it's going to be very important for an enclave as well you don't want an attacker to be able to extract keys so here for an entree we will focus on software threat models so we will not consider hardware threat models where an attacker has access to the Enclave because that's pretty much out of scope I mean waves are quite complex and it's difficult to focus on securing as a whole thing against a physical attacker then user confirmation is extremely important as well because if you want crave is holding keys but users can an attacker or malware can sign anything it's not very secure so you should be able to confirm what you are doing and you should be it shouldn't be possible to fake this confirmation if your malware then flexibility you should be able to do software updates on your hard wallet Enclave anytime so even if your computer is compromised which is quite important and as a developer you should be able to test new functionalities typically for atrium if you want clave is signing an interim transaction it should be able to support smart contracts and should be able if possible to display specific UX for specific smartphone twice in order to provide always the best and the clearest message to the user to know what you are doing finally remote at the station we should have a way in an enclave or in like we have in the device to verify that the code is running and a healthy platform and that you are running the right code so you should be able to verify which code you're running and we'll see that this comes with with some difficulties on HDX but we can help solving that as well so today in our architecture the way we achieved source code portability between secure element and enclaves is quite simple we focus on C source code portability so we write the code once with the same API when we work natively on the secure element we are compiling to arm because our secure element are based on sicker sicker of course which is a kind of a secure arm and when we are working on an enclave all kind of Enclave so it could be HDX te or NHS M we are cross compiling to moxie which is an open architecture which was used usually in which was used previously or in the Bitcoin project as an experiment by Jeff Kazik back in the days but it's very simple it's very easy to review easy to secure as well so it's a good target if you want to have a simple VM regarding the architecture itself we will try to reuse this model as much as we can so we want to protect the user secrets the user secrets will sit between a kind of a firewall applications will be firewall between each other as well and when an application wants to access some cryptographic material it will use it will use a service call so service cool on arm or something else Universal machine to access the secrets so applications can't touch secret unless the interpreter mode which is run by the kernel and applications are isolated and of course come touch a camel so if we look at the state of our HDX stack in 2017 we had good points and but so the first good point is that it works so if you want to try it today you can do something you can run some simple applications you can we demonstrate it on China at the station so you can verify that your Enclave is legitimate on chain after you pass internet a station you can verify that your code is the code that is supposed to be on chain and we have an open source sdk even if the code is deprecated it's still completely usable and you can still play with it on the bad side on the negative side you we had no user confirmation possible since we didn't have a display API so you couldn't use it really as a wallet so if all code that you wanted to run on the Enclave had to be signed by us so that the biggest things that deter people from using the Enclave because at some point if you wanted to run with in a protected environment you had to send us the code or we had to assign a key which was more convenient but still a lot of people didn't want to contact us for that so that's why in my opinion it wasn't very popular and of course we did no security audit so the code is really sent to you to be to be tried and without any kind of guarantee so how can we improve that of course regarding the attestation well people have been talking about Intel at the station a lot so the thing is internet station today is still very useful in my opinion because you need to validate the platform house from time to time for example when there is a new security exploit that involves updating your bios updating the microcode of your cpu the only way to know that is to have a centralized API at some point so it's still used today but you can select different setups depending what you want for your application when you are using your Enclave so if you don't want to use internet a station you can it works the code is still secure because the code is signed so you can verify you can rebuild the code on your side and verify that the crisco right but in this case you don't get remote at the station at all it's a choice if you want to run your wallet on your side you can do that maybe not the best choice but it's a choice you can run internet sensation once if you do that you get a week later at the station I put week here because it will not be up to date regarding the health of your platform which can change so again it's a choice but if you do internet if you run internet sensation from time to time then you can get a stronger attestation and the biggest difference here according to compare to is at the station today is that it's something you can validate on chain so the good news is that with a new in therapy I call protected connection display we can solve two problems so we can solve the confirmation if you and we can solve the fact that you couldn't run on any moose code so far so now you won't have to contact us to run your code on the Enclave once this is released so if we want to summarize very quickly get an overview of protected transaction display it will be a way to create a secure display to display something securely so on your own device that will be prepared by the Enclave so the way this works is that PTD will allow you to create confidential output on display so the display here is a mixed display in this window you have a mixed display so some is done by PTD so can't be spied on by the host so PIN pad here is done by PTD this line is displayed by PT d and this line is displayed by PT D as well the buttons are not and this label and string are not so the input the output is confidential because the host cannot read anything and with the fact that you can display a pin code that is randomly swap by PT D you can achieve confidential input as well because if for example here you type your PIN code so host has asked no way to know that you typed one two three four if you kick that I mean the host will just see that you clicked some turns on your screen but this way you can manage to have some securing put even if it's not very convenient and here we have a way to display some additional data on PTD so you see an amount which is an amount of 0.096 errors so here you see the number of decimal below which is again not the best UI but well I'm that's what you can do today and part of a native remedy right so after you do that after you enter your PIN wallet codes and hand it around addiction limitations we have repeatedly today they eat the output is confidential so the output cannot be spied on but it cannot be trusted because you can still display something on top of the output so in this case that's why we are do that's why we are you have to do this user confirmation twice so it's not the best you expose evil but I would say it works with what is available there so the IO primitives are very limited today that's probably something that can change but you don't have the flexibility of global platform te twisted UI if you want so one thing that's popular in with the CPI is to basically register an image on the server and then this play this image so you can be sure that nobody can intercept the image and a malware on the host could not replace it was the UI but you can't in that case so that's why you have to add the user type again and confirm twice which is not the most convenient thing but it works so the alternative options you can think of or at least I can think of hours and typically if I want a user to if I want to use it to verify that was the UI is genuine you would have to train your users to try to take screenshots for example and see that the contact screenshots so that's not something is really realistic I mean geeks can probably do that but that's a regular user and so five windows only so if you want to run those tests you can't want them online X that will probably change over time as well we are still to one part we are still missing compared to 2017 is a security audit and that's what we will be focusing on right now and that's the reason why I didn't update the code because we didn't run our security audit yet so on the first part of the security audit you want to run that like a standard security audit so you want to verify that your own clave is not vulnerable to typical bugs buffer overflows and so on so that's very very normal then you want to verify something more you want to see if your key can withstand server side channel attacks because side channel attacks got very popular during last year so more and more people I've been able to have been demonstrating ways to extract keys from enclaves either by attacking the Enclave from another one of whom the host and today that was still a state of the art to be written to know if keys are correctly protected in an enclave and we aren't we are very interested to answer this question we're very interested to publish result and we want to advance the state of the art of protecting key and Enclave so good news is that we are I think good at it at least we already did it on hardware so we should be able to do it and bigger hollow as well and I just run them at the adjustment which is not very related to side channel on a cache but it's a general Zhai channel api that we published a few days ago that will let you test on state of the art state channel on completing so how can we how will we proceed with this audit so first we'll focus on a single curve will focus on SEC P 256 K 1 which is a curved used by a lot of kryptos today so at least Bitcoin and aetherium so for the time being that the curve we are the most interested in we will review the state-of-the-art library used to dye power by multiple project coming from Bitcoin core so ellipsoid P 256 K 1 and we will test it against state-of-the-art side channel attacks that we have on hgx we will publish a review on that detailed report if there are patches to be written we will do that as well if we have some well parts to rewrite we will also do that and in the end we want to know if and when how long we can store keys on HDX and I think that using this research we will be able to finally have a workable and workable hardware wallet on an enclave and with strong guarantees that the keys are going to be available and that the keys are not going to be stolen for a given amount of time so for this we chose not to use the Intel proprietary the graphic library because we figure that working on an open source code and providing some providing some review of that will benefit more to the community by knowing how we can how we can work and design new side-channel protection attacks which could later be applied to other curves so to finish summary of what is coming next in 2019 for Enclave first we want to start with the CTF so after with you we will test so we will publish what we did with our hardened API and well standard CTF so if you win you get better because well we'll put some ads in our Enclave so we will usually increase the amount and we'll see if people are interested in if people manage to extract something as I talked for cryptographic API on our Hardware wallet so that works on well - bitcoins I think on one Bitcoin nobody steal it nobody stole it on to bitcoins we found some motivated parties so maybe we will see the same here after we do that and we're convinced that our security is fine then we can we will be able to release the wallet so we will really the simple wallet that will work first for Bitcoin in atrium and then we can move forward and release an SDK that will let people write their own application and use PTD to secure their own applications so that's it and we still have some minutes for questions if you want you