LAS for Development

We explain how to start a Local Attestation Service (LAS) instance for development. LAS is need to perform a local attestation (i.e., this creates a quote that can be verified by CAS). Note that this LAS runs inside a debug enclave, i.e., do not use this LAS instance in production. For setting up a production mode LAS, send us an email.

For running LAS in a Kubernetes Cluster, please set up LAS with helm.

Pulling LAS Image

To start LAS, you first pull LAS to your local registry. To do so, please set the environment variable LAS to the image repository that we given you access to. The standard LAS image name is defined as follows:

export LAS=sconecuratedimages/services:las

Pull the image from Docker hub like this:

docker pull $LAS

If this fails, ensure that you are logged into docker (via docker login) and that we granted you access to that image.

Selecting the SGX device

Depending on the platform, the SGX device is named /dev/isgx or /dev/sgx. To write generic software, you could define some function to select the correct device:

function set_sgx_device {
    export DEVICE="/dev/sgx"

    if [[ ! -c "$DEVICE" ]] ; then
        export DEVICE_O="$DEVICE"
        export DEVICE="/dev/isgx"
        if [[ ! -c "$DEVICE" ]] ; then
            echo "Neither $DEVICE_O nor $DEVICE exists"
            exit 1
        fi
    fi
}
set_sgx_device

Starting and Stopping LAS

The easiest way to start LAS is to use a simple Docker compose file. Please create a separate directory for that:

mkdir -p LAS
cd LAS

Create the following compose file:

set_sgx_device
cat > docker-compose.yml <<EOF
version: '3.2'
services:
    las:
        image: sconecuratedimages/services:las
        devices:
         - "$DEVICE"
        ports:
          - target: 18766
            published: 18766
            protocol: tcp
            mode: host
EOF

Now start LAS in the background as follows:

docker-compose up -d las

By executing

docker-compose logs las

you will see the output of LAS.

You can check if LAS is still running by executing:

docker-compose up -d las

This will result in an output like

las_las_1 is up-to-date

You can stop LAS by executing:

docker-compose stop