Enarx - Attested, Secured Execution with AMD’s SEV

### Overview This presentation introduces the Enarx open-source project and explores how it leverages hardware-based trusted execution environments (TEEs), focusing particularly on AMD's Secure Encrypted Virtualization (SEV) technology. The talk begins with David outlining the hardware mechanisms and cryptographic attestation flows of AMD SEV and SEV-ES, followed by Nathaniel explaining the design goals, architecture, and deployment model of Enarx.

### Key Topics - **AMD SME and SEV Capabilities**: Hardware-level AES-128 memory encryption built into Zen processor memory controllers. SME provides transparent DRAM encryption using a single randomly generated boot key. SEV builds on this by assigning separate encryption keys per VM (up to 15 in first-gen EPYC, up to 509 in second-gen EPYC) to isolate guest memory from other VMs and the hypervisor. - **AMD Secure Processor and SEV-ES**: The AMD Secure Processor (PSP, an ARM Cortex-A5 core with private SRAM) acts as the hardware root of trust managing keys and lifecycle tasks. SEV-ES (Encrypted State) adds atomic guest register state protection across world switches and uses a Guest-Hypervisor Communication Block (GHCB) for controlled interaction with the hypervisor. - **Cryptographic Attestation and Secret Injection**: The SEV launch flow measures initial guest memory pages into an HMAC. Attestation uses platform Diffie-Hellman (PDH) keys verified via an Owner Certificate Authority (OCA) and an AMD root-of-trust certificate chain. A verified guest owner can inject secrets over an encrypted Diffie-Hellman channel to boot the VM. - **The Enarx Project Architecture**: Enarx is an open-source (Apache 2.0, written in Rust) deployment framework rather than a development SDK. It aims to eliminate trust dependencies across the middle layers of the traditional virtualization/container stack (hypervisor, host OS, firmware) by deploying applications into hardware "keeps" across both VM-based (e.g., AMD SEV) and process-based (e.g., Intel SGX) TEE architectures. - **Application Portability via WebAssembly**: Developers write standard applications and compile them to WebAssembly targeting the WebAssembly System Interface (WASI). Inside the secure keep, Enarx runs a WebAssembly JIT compiler to run the binary, preventing hardware vendor lock-in. - **Security Best Practices by Default**: Enarx enforces strict operational security, including TLS networking (via projects like cipher-pipe and TLS sock), encrypted persistent block storage, independent keep random number generators, and minimized host APIs.

### Technical Details - **Live Demonstration**: A client attested an empty AMD SEV virtual machine directly against the AMD firmware/processor. After validating the certificate chain and the launch measurement of the empty VM, the client delivered encrypted code and data over a session key with perfect forward secrecy. The firmware injected the code, executing a 3 + 4 addition operation that produced 7 in approximately 50 milliseconds of local overhead. - **Kernel/Runtime Considerations**: Enarx is investigating a "mono-kernel" approach combining hypervisor, kernel, and application into one binary, avoiding Linux in the keep to maintain Apache 2.0 licensing and cross-compatibility with process-based enclaves.

### Takeaways Enarx abstracts the fragmentation across hardware TEE implementations by using WebAssembly and WASI. This allows developers to maintain homogeneous binaries that can be deployed to any supported secure hardware environment, switching platforms if vulnerabilities emerge without code refactoring.