anjuna-encrypt

Encrypt a file for enclaves powered by Anjuna.

Synopsis

anjuna-encrypt --public-key <pubkey_file> <plaintext_file>

Description

The anjuna-encrypt tool is used to encrypt data for enclaves running in the Anjuna SGX Runtime.

Encrypting files for a specific enclave

One option is to encrypt data for a specific enclave once it has been established that the enclave is trusted. See anjuna-check-attestation to learn about verifying whether an enclave is trusted.

Using the anjuna-encrypt tool, a client can ensure that sensitive secrets are securely transmitted to the enclave.

The anjuna-encrypt tool uses the public key (RSA key in PEM format) generated by an enclave during the provisioning step to encrypt a specific file for this enclave.

The anjuna-encrypt tool can encrypt files up to 16MB.

If the encryption operation succeeds then a new file is created with the same name as the original file, but with the ".sealed" extension.

Encrypting files protected by APM keys

Another option is to encrypt a file, which the enclave decrypts using a key stored in the APM. See Configuring the Policy Manager to learn about using the Anjuna Policy Manager for file encryption.

Using the anjuna-encrypt tool, a client can encrypt files for enclaves using the keys stored in the APM.

As before, if the encryption operation succeeds, then the new file name will be the same as the original file, but with the ".sealed" extension.

Encrypting files with an AES128 key

Using the command-line flag --aes-key, a client can also encrypt files using an AES128 symmetric encryption key. The resulting ".sealed" file can be decrypted with the same key using anjuna-decrypt or any other AES128 decryption tool.

Options

Usage: anjuna-encrypt [OPTIONS] PLAINTEXT_FILENAME
    --aes-key string      Base64 encoded AES128 key to encrypt the file with
    -o, --out string          Encrypted output filename (default appends ".sealed" to input filename)
    -k, --public-key string   Public RSA key that will wrap the symmetric file-encryption key

Exit status

anjuna-encrypt returns 0 on success and 1 on failure.

Examples

$ anjuna-encrypt --public-key provision/python.pubkey my-secret-key
$ anjuna-encrypt --aes-key V0hZIFlPVSBERUMgVEhJUw== my-secret-data