What is the purpose of running PBFT inside enclave?

[MingyuanGao]

Hello, CCF Team, thank you for this excellent open-source project. From the build system, PBFT code is linked to the enclave part. Is it correct to say that PBFT totally runs inside the enclave? If this is the case, what is the purpose of running PBFT inside the enclave? Thanks in advance.

[ashamis]

Hi Mingyuan, we run the consensus protocol inside of an enclave as a way of hardening the protocol as its harder to attack code running inside an enclave as compared to code that is not.

[MingyuanGao]

Thank you so much.

[Parsifal0]

Hi Mingyuan, we run the consensus protocol inside of an enclave as a way of hardening the protocol as its harder to attack code running inside an enclave as compared to code that is not.

Hello, Ashamis. Does moving consensus, i.e., the replication protocols, outside enclaves break the confidentiality/security of CCF? Since the local ledger storage is already encrytped in the disk, it seems that placing consensus in the host side is fine. Thanks for your attention.

[ashamis]

@Parsifal0 It is possible to move the Byzantine consensus outside the enclave and still maintain similar security properties. However, this would required a well thought-out change as an naive solution will probably results in some security and confidentiality issues.

[Parsifal0]

Thanks! It does make sense. Putting consensus inside enclaves or not is just an implementation choice, which doesn't impact the threat model of CCF. If one tends to keep consensus outside enclaves, he may need extra steps (e.g., signature verification) to communicate with the consensus.

[ashamis]

Its part of a defense in depth strategy