envoyproxy/envoy

Wasm module signature verification

Open

#17,220 opened on Jul 2, 2021

View on GitHub
 (5 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/securityarea/wasmenhancementhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Title: Wasm module signature verification

Description: Add the ability to configure verification options to satisfy before executing a Wasm module. This could include checking all/some/at least one signature is present from a list of specified verification keys in the Wasm bytecode according to https://github.com/jedisct1/wasmsign. I propose some kind of VerificationOption struct that contains

  • repeated public keys
  • verification type (at least 'n', ALL)
  • signature type (maybe reference to wasmsign)

If this is something interesting/use-able to others, I am happy to continue implementation.

Relevant Links Draft PR here: https://github.com/envoyproxy/envoy/pull/17221 The change depends on a PR in proxy-wasm-cpp-host: https://github.com/proxy-wasm/proxy-wasm-cpp-host/pull/177

Contributor guide

Research direction
Examine the draft PR and the dependency PR in proxy wasm cpp host. Understand the wasmsign library to implement a VerificationOption struct and integrate signature verification into the Wasm module loading flow.
Tech stack
cpprustwasm
Domain
backendsecurityinfrastructure
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
C++GitWasm
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40