oak icon indicating copy to clipboard operation
oak copied to clipboard

Rename RKernel SDK modules

Open ipetr0v opened this issue 11 months ago • 1 comments

This PR:

  • Splits instance_attestation into attestation and crypto modules
    • Because attestation module will be removed once we have an Orchestrator for RKernel
    • And crypto module will contain the logic for both Instance and Group keys
  • Renames mock_attestation to testing since it not only contains the attestation logic but also the crypto logic

ipetr0v avatar Mar 14 '24 11:03 ipetr0v

What is the migration plan for our clients?

Internal clients depend on a specific commit. So once we submit this PR, we would be able to update their code that reference them to the new commit

ipetr0v avatar Mar 14 '24 12:03 ipetr0v

I don't have a strong objection to merging this.

But the rationale for the original naming choice of attestation that the provided crypto functions operate with keys that are specifically bound to the attestation. — Even if we remove the struct get the evidence itself, the signing and encryption keys are still bound to it.

@ipetr0v How would you want to handle group attestation if we support it in the future? The current mod was called instance_attestation, so we'd have the option of additionally offering an additional group_attestation mod in the future.

jul-sh avatar Mar 15 '24 09:03 jul-sh

I don't have a strong objection to merging this.

But the rationale for the original naming choice of attestation that the provided crypto functions operate with keys that are specifically bound to the attestation. — Even if we remove the struct get the evidence itself, the signing and encryption keys are still bound to it.

@ipetr0v How would you want to handle group attestation if we support it in the future? The current mod was called instance_attestation, so we'd have the option of additionally offering an additional group_attestation mod in the future.

There will be no group attestation, only group encryption. So GroupEvidenceProvider will not be there. And GroupKeyHandle will be in the crypto module.

Also I think from the point of view of our clients crypto is not a part of the attestation. It's definitely bound to it, but it's a separate logic on top of this.

ipetr0v avatar Mar 15 '24 10:03 ipetr0v