ehsm
ehsm copied to clipboard
intel
An End-to-End Distributed and Scalable Cloud KMS (Key Management System) built on top of Intel SGX enclave-based HSM (Hardware Security Module), aka eHSM.
according to the cloud kms, the digest need to be hashed by the user, so the sign operation may not need to hash it again. e.g, ecc/rsa/sm2
cmk will need to be upgraded or maybe expired, so need to consider to support its rotation in future.
attach the attestation token into the request params to assure the kms is actually run in the enclave.
## Background [SM9 ](https://en.wikipedia.org/wiki/SM9_(cryptography_standard)) is a Chinese national cryptography standard for [Identity Based Cryptography](https://en.wikipedia.org/wiki/ID-based_cryptography) issued by the Chinese State Cryptographic Authority in March 2016(`from wikipedia`). it is also standardized in[...
- add dkeyrotation app - dkeyserver(root), dkeyserver(worker), dkeycache and KMS server are support domain key rotation. test : passed the local test Signed-off-by: wanghouqi
