Appendix

Additional reference materials for further reading.

Cryptography

The enclaves in the Enigma protocol use public-key cryptography, also known as asymmetric cryptography, which uses a pair of keys: a public key that may be disseminated widely, and a private key that is known only to the enclave. This accomplishes two functions: authentication, where the public key verifies that a holder of the paired private key sent the message, and encryption, where only the paired private key holder can decrypt the message encrypted with the public key.

Within the realm of public-key cryptography, Enigma uses elliptic curve (EC) cryptography, which provides smaller key sizes and faster operations for approximately equivalent estimated security.

Elliptic Curve

The Enigma Protocol uses the secp256k1 curve for both signing and encryption keys, as it’s standard in Bitcoin/Ethereum (though the keys themselves should not be the same). secp256k1 is not considered a safe curve, but it’s unclear if that opens any vector of attack, and it’s good enough for Bitcoin/Ethereum. (See SafeCurves; all the attacks listed there against secp256k1 are theoretical only.)

secp256k1 was constructed in a special, non-random way that allows for especially efficient computation. As a result, it is often more than 30% faster than other curves when the implementation is sufficiently optimized. Also, unlike the popular NIST curves, secp256k1’s constants were selected in a predictable way, which significantly reduces the possibility that the curve’s creator inserted a backdoor into the curve.

Alternatives: Cardano/Ouroboros uses the secp256r1 curve for ECDSA, though we see no good reason to use secp256r1, as it has almost the same security as secp256k1. The only difference is that secp256k1 uses the “Koblitz curve,” which means there is less chance of a backdoor, because the constants aren’t random. If at some point we no longer need compatibility with Bitcoin/Ethereum, we should use something like Curve25519, which is considered a “safe curve.”

Signing

For signing, the Enigma Protocol uses the Elliptic Curve Digital Signature Algorithm (ECDSA) with keccak256 as the hashing function (for compatibility with Ethereum’s Solidity), a variant of the Digital Signature Algorithm that uses elliptic curve cryptography. ECDSA is used by most blockchains.

Encryption

For encryption, the Enigma Protocol uses an adaptation of Elliptic Curve Diffie-Hellman (ECDH), an anonymous key agreement protocol that allows two parties to establish a shared secret over an insecure channel.

The enclave can make its public key known a priori. Any user who wants to encrypt a message for the enclave can generate a one-time asymmetric key pair, and use that to derive a one-time symmetric key, as in the usual ECDH protocol. The one-time symmetric key is generated with a key derivation function (KDF) that is yet to be specified. The symmetric-key algorithm used for encryption is most likely the Advanced Encryption Standard (AES) with GCM mode (Galois/Counter Mode), which adds a Hash-based Message Authentication Code (HMAC) for message authentication and protects against a number of known attack vectors on AES. The encryption uses a key length of 256 bits.

The user can then use that secret to encrypt a message, and send the enclave both the encrypted message and the public key used. With that information, the enclave can derive the symmetric key and decrypt the message.

(Side note: if we want authentication as well, we may need to sign these messages too, but that is still to be determined. User authentication toward enclaves is not considered a priority at this stage.)

Elliptic Curve Integrated Encryption Scheme (ECIES) was also considered as an option for encryption, given its similarity to ECDH. The reason to prefer ECDH over ECIES is that ECIES is not yet standardized, does not add much additional security to the protocol, and — because it isn’t standardized — is not implemented by most known cryptography libraries (which also means it hasn’t been tested as thoroughly).

Implementation

For the PoC, the Enigma Protocol implements all of the above cryptographic algorithms in Python using the pyca/cryptography package. The Enigma implementation of the cryptographic primitives can be found in the core repository: core/src/core/cryptography (develop branch).

In the near future, we may move to a C/C++ library that is compatible with the SGX implementation, to be run natively inside an SGX enclave. The implementation under consideration is Crypto++, a free C++ class library of cryptographic schemes that includes all the algorithms outlined above.