[svsm-devel] Questions about crypto support

[Dionna Amalie Glaze]

> > Q3) What libc implementation should we use to build OpenSSL and other CPL3
> > modules?
>
> What amount of libc does openssl need? Or how much is it beyond
> malloc/free? Whatever libc we chose, some porting efforts to the SVSM
> syscall interface will be needed.
>

I've written some stubs to enable the crypto components of BoringSSL
(trimmed-down OpenSSL) in a nostdlib environment, and it's not
insignificant.

There are a number of string manipulation functions, of course
malloc/free, and also pthread_once and pthread_key_* functions.
Without pthreads, you have to build with
-DOPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED
I don't know what the concurrency story is for SVSM, but I imagine
it's concurrent for all vCPUs to use without a global lock.

>
> > Q6) Interface 3. How a CPL3 module should communicate with other CPL3 modules?
> > It may also need to carry secrets such as keys.
>
> For secrets like the VMPCK keys there should be a single owner, or do
> you see a need to pass those around? Besides secrets, communication will
> be done via the TBD IPC mechanism.
>

VMPCKs may have a single conceptual owner, but they'll still need to
be used in cryptographic operations, so I do see them getting passed
around.

-- 
-Dionna Glaze, PhD (she/her)