Merge pull request #133 from skalenetwork/SKALE-3067-remove-use-check

Skale 3067 remove use check

DKGCrypto.cpp

@@ -35,6 +35,8 @@
 #include "third_party/spdlog/spdlog.h"
 #include "common.h"
 
+
+
 vector<string> splitString(const char *coeffs, const char symbol) {
     string str(coeffs);
     string delim;

VERSION

-1.54.0
+1.56.0

secure_enclave/AESUtils.c

@@ -29,8 +29,29 @@
 
 #include "AESUtils.h"
 
-int AES_encrypt(char *message, uint8_t *encr_message) {
+int AES_encrypt(char *message, uint8_t *encr_message, uint64_t encrLen) {
+
+    if (!message) {
+        LOG_ERROR("Null message in AES_encrypt");
+        return -1;
+    }
+
+    if (!encr_message) {
+        LOG_ERROR("Null encr message in AES_encrypt");
+        return -2;
+    }
+
+    auto len = strlen(message);
+
+    if (len + SGX_AESGCM_MAC_SIZE + SGX_AESGCM_IV_SIZE > encrLen ) {
+        LOG_ERROR("Output buffer too small");
+        return -3;
+    }
+
     sgx_read_rand(encr_message + SGX_AESGCM_MAC_SIZE, SGX_AESGCM_IV_SIZE);
+
+    auto msgLen = strlen(message);
+
     sgx_status_t status = sgx_rijndael128GCM_encrypt(&AES_key, (uint8_t*)message, strlen(message),
                                                      encr_message + SGX_AESGCM_MAC_SIZE + SGX_AESGCM_IV_SIZE,
                                                      encr_message + SGX_AESGCM_MAC_SIZE, SGX_AESGCM_IV_SIZE,
@@ -40,9 +61,23 @@ int AES_encrypt(char *message, uint8_t *encr_message) {
     return status;
 }
 
-int AES_decrypt(uint8_t *encr_message, uint64_t length, char *message) {
+int AES_decrypt(uint8_t *encr_message, uint64_t length, char *message, uint64_t msgLen) {
+
+
+  if (length < SGX_AESGCM_MAC_SIZE + SGX_AESGCM_IV_SIZE) {
+      LOG_ERROR("length < SGX_AESGCM_MAC_SIZE - SGX_AESGCM_IV_SIZE");
+      return -1;
+  }
+
+
+
   uint64_t len = length - SGX_AESGCM_MAC_SIZE - SGX_AESGCM_IV_SIZE;
 
+  if (msgLen < len) {
+        LOG_ERROR("Output buffer not large enough");
+        return -2;
+  }
+
   sgx_status_t status = sgx_rijndael128GCM_decrypt(&AES_key,
                                                    encr_message + SGX_AESGCM_MAC_SIZE + SGX_AESGCM_IV_SIZE, len,
                                                    message,

secure_enclave/AESUtils.h

@@ -26,8 +26,8 @@
 
 sgx_aes_gcm_128bit_key_t AES_key;
 
-int AES_encrypt(char *message, uint8_t *encr_message);
+int AES_encrypt(char *message, uint8_t *encr_message, uint64_t encrLen);
 
-int AES_decrypt(uint8_t *encr_message, uint64_t length, char *message);
+int AES_decrypt(uint8_t *encr_message, uint64_t length, char *message, uint64_t msgLen) ;
 
 #endif //SGXD_AESUTILS_H

secure_enclave/EnclaveCommon.cpp

@@ -36,6 +36,14 @@
 
 using namespace std;
 
+thread_local  uint8_t decryptedDkgPoly[DKG_BUFER_LENGTH];
+
+uint8_t* getThreadLocalDecryptedDkgPoly() {
+
+    return decryptedDkgPoly;
+}
+
+
 string *stringFromKey(libff::alt_bn128_Fr *_key) {
     mpz_t t;
     mpz_init(t);

secure_enclave/EnclaveCommon.h

@@ -47,6 +47,8 @@ EXTERNC void enclave_init();
 
 void get_global_random(unsigned char* _randBuff, uint64_t size);
 
+EXTERNC uint8_t* getThreadLocalDecryptedDkgPoly();
+
 EXTERNC void LOG_INFO(const char* msg);
 EXTERNC void LOG_WARN(const char* _msg);
 EXTERNC void LOG_ERROR(const char* _msg);

secure_enclave/secure_enclave.c

@@ -56,7 +56,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include "EnclaveConstants.h"
 #include "EnclaveCommon.h"
 
-uint8_t decryptedDkgPoly[DKG_BUFER_LENGTH];
+
 
 void *(*gmp_realloc_func)(void *, size_t, size_t);
 
@@ -129,8 +129,31 @@ void *reallocate_function(void *ptr, size_t osize, size_t nsize) {
     return (void *) nptr;
 }
 
+
+#define CHECK_STATE(_EXPRESSION_) \
+    if (!(_EXPRESSION_)) {        \
+        LOG_ERROR("State check failed::");LOG_ERROR(#_EXPRESSION_); \
+        LOG_ERROR(__FILE__); LOG_ERROR(__LINE__);                   \
+        snprintf(errString, BUF_LEN, "State check failed. Check log."); \
+        *errStatus = -1;                          \
+        return;}
+
+#define CHECK_STATE_CLEAN(_EXPRESSION_) \
+    if (!(_EXPRESSION_)) {        \
+        LOG_ERROR("State check failed::");LOG_ERROR(#_EXPRESSION_); \
+        LOG_ERROR(__FILE__); LOG_ERROR(__LINE__);                   \
+        snprintf(errString, BUF_LEN, "State check failed. Check log."); \
+        *errStatus = -1;                          \
+        goto clean;}
+
 void get_global_random(unsigned char *_randBuff, uint64_t _size) {
-    assert(_size <= 32);
+
+    char errString[BUF_LEN];
+    int *errStatus;
+
+    CHECK_STATE(_size <= 32)
+    CHECK_STATE(_randBuff);
+
     sgx_sha_state_handle_t shaStateHandle;
     assert(sgx_sha256_init(&shaStateHandle) == SGX_SUCCESS);
     assert(sgx_sha256_update(globalRandom, 32, shaStateHandle) == SGX_SUCCESS);
@@ -141,18 +164,17 @@ void get_global_random(unsigned char *_randBuff, uint64_t _size) {
 }
 
 
-void trustedEMpzAdd(mpz_t *c_un, mpz_t *a_un, mpz_t *b_un) {}
-
-void trustedEMpzMul(mpz_t *c_un, mpz_t *a_un, mpz_t *b_un) {}
-
-void trustedEMpzDiv(mpz_t *c_un, mpz_t *a_un, mpz_t *b_un) {}
-
-void trustedEMpfDiv(mpf_t *c_un, mpf_t *a_un, mpf_t *b_un) {}
 
 void trustedGenerateEcdsaKey(int *errStatus, char *errString,
                              uint8_t *encryptedPrivateKey, uint32_t *enc_len, char *pub_key_x, char *pub_key_y) {
     LOG_DEBUG(__FUNCTION__);
 
+
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(pub_key_x); CHECK_STATE(pub_key_y);
+
+
+
     domain_parameters curve = domain_parameters_init();
     domain_parameters_load_curve(curve, secp256k1);
 
@@ -221,6 +243,10 @@ void trustedGenerateEcdsaKey(int *errStatus, char *errString,
 void trustedGetPublicEcdsaKey(int *errStatus, char *errString,
                               uint8_t *encryptedPrivateKey, uint32_t dec_len, char *pub_key_x, char *pub_key_y) {
     LOG_DEBUG(__FUNCTION__);
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(errString);
+    CHECK_STATE(pub_key_x);
+    CHECK_STATE(pub_key_y);
 
     domain_parameters curve = domain_parameters_init();
     domain_parameters_load_curve(curve, secp256k1);
@@ -299,6 +325,13 @@ void trustedEcdsaSign(int *errStatus, char *errString, uint8_t *encryptedPrivate
                       unsigned char *hash, char *sigR, char *sigS, uint8_t *sig_v, int base) {
     LOG_DEBUG(__FUNCTION__);
 
+
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(hash);
+    CHECK_STATE(sigR);
+    CHECK_STATE(sigS);
+    CHECK_STATE(base > 0);
+
     char *arrR = NULL;
     char *arrS = NULL;
 
@@ -310,14 +343,6 @@ void trustedEcdsaSign(int *errStatus, char *errString, uint8_t *encryptedPrivate
     domain_parameters_load_curve(curve, secp256k1);
     point publicKey = point_init();
 
-    if (!hash) {
-        *errStatus = 1;
-        char *msg = "NULL message hash";
-        LOG_ERROR(msg);
-        snprintf(errString, BUF_LEN, msg);
-        goto clean;
-    }
-
     if (strnlen(hash, 64) > 64) {
         *errStatus = 2;
         char *msg = "Hash too long";
@@ -408,6 +433,8 @@ void trustedEcdsaSign(int *errStatus, char *errString, uint8_t *encryptedPrivate
 void trustedEncryptKey(int *errStatus, char *errString, const char *key,
                        uint8_t *encryptedPrivateKey, uint32_t *enc_len) {
     LOG_DEBUG(__FUNCTION__);
+    CHECK_STATE(key);
+    CHECK_STATE(encryptedPrivateKey);
 
     *errStatus = UNKNOWN_ERROR;
 
@@ -463,6 +490,7 @@ void trustedEncryptKey(int *errStatus, char *errString, const char *key,
 void trustedDecryptKey(int *errStatus, char *errString, uint8_t *encryptedPrivateKey,
                        uint32_t enc_len, char *key) {
     LOG_DEBUG(__FUNCTION__);
+    CHECK_STATE(key);
 
     uint32_t decLen;
 
@@ -500,6 +528,11 @@ void trustedBlsSignMessage(int *errStatus, char *errString, uint8_t *encryptedPr
                            char *_hashY, char *signature) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(_hashX);
+    CHECK_STATE(_hashY);
+    CHECK_STATE(signature);
+
     char key[BUF_LEN];
     char *sig = (char *) calloc(BUF_LEN, 1);
 
@@ -527,6 +560,8 @@ void trustedBlsSignMessage(int *errStatus, char *errString, uint8_t *encryptedPr
 void trustedGenDkgSecret(int *errStatus, char *errString, uint8_t *encrypted_dkg_secret, uint32_t *enc_len, size_t _t) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_dkg_secret);
+
     char dkg_secret[DKG_BUFER_LENGTH];
 
     if (gen_dkg_poly(dkg_secret, _t) != 0) {
@@ -553,6 +588,8 @@ trustedDecryptDkgSecret(int *errStatus, char *errString, uint8_t *encrypted_dkg_
                         uint32_t *dec_len) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_dkg_secret);
+
     uint32_t decr_len;
     sgx_status_t status = sgx_unseal_data(
             (const sgx_sealed_data_t *) encrypted_dkg_secret, NULL, 0, decrypted_dkg_secret, &decr_len);
@@ -569,6 +606,11 @@ trustedDecryptDkgSecret(int *errStatus, char *errString, uint8_t *encrypted_dkg_
 void trustedGetSecretShares(int *errStatus, char *errString, uint8_t *encrypted_dkg_secret, uint32_t *dec_len,
                             char *secret_shares,
                             unsigned _t, unsigned _n) {
+
+    CHECK_STATE(encrypted_dkg_secret);
+    CHECK_STATE(secret_shares);
+    CHECK_STATE(_t <= _n);
+
     LOG_DEBUG(__FUNCTION__);
 
     char decrypted_dkg_secret[DKG_BUFER_LENGTH];
@@ -591,6 +633,11 @@ void trustedGetPublicShares(int *errStatus, char *errString, uint8_t *encrypted_
                             unsigned _t, unsigned _n) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_dkg_secret);
+    CHECK_STATE(public_shares);
+    CHECK_STATE(_t <= _n);
+    CHECK_STATE(_n > 0);
+
     char *decrypted_dkg_secret = (char *) calloc(DKG_MAX_SEALED_LEN, 1);
     uint32_t decr_len;
     trustedDecryptDkgSecret(errStatus, errString, (uint8_t *) encrypted_dkg_secret, (uint8_t *) decrypted_dkg_secret,
@@ -613,10 +660,13 @@ void trustedGetPublicShares(int *errStatus, char *errString, uint8_t *encrypted_
 void trustedSetEncryptedDkgPoly(int *errStatus, char *errString, uint8_t *encrypted_poly) {
     LOG_DEBUG(__FUNCTION__);
 
-    memset(decryptedDkgPoly, 0, DKG_BUFER_LENGTH);
+    CHECK_STATE(encrypted_poly);
+
+    memset(getThreadLocalDecryptedDkgPoly(), 0, DKG_BUFER_LENGTH);
     uint32_t decr_len;
     sgx_status_t status = sgx_unseal_data(
-            (const sgx_sealed_data_t *) encrypted_poly, NULL, 0, decryptedDkgPoly, &decr_len);
+            (const sgx_sealed_data_t *) encrypted_poly, NULL, 0,
+            getThreadLocalDecryptedDkgPoly(), &decr_len);
 
     if (status != SGX_SUCCESS) {
         *errStatus = -1;
@@ -628,8 +678,17 @@ void trustedSetEncryptedDkgPoly(int *errStatus, char *errString, uint8_t *encryp
 void trustedGetEncryptedSecretShare(int *errStatus, char *errString, uint8_t *encrypted_skey, uint32_t *dec_len,
                                     char *result_str, char *s_shareG2, char *pub_keyB, uint8_t _t, uint8_t _n,
                                     uint8_t ind) {
+
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_skey)
+    CHECK_STATE(result_str);
+    CHECK_STATE(s_shareG2);
+    CHECK_STATE(pub_keyB);
+    CHECK_STATE(_t <= _n);
+    CHECK_STATE(_n > 0);
+
+
     char skey[ECDSA_SKEY_LEN];
     char pub_key_x[BUF_LEN];
     memset(pub_key_x, 0, BUF_LEN);
@@ -658,7 +717,7 @@ void trustedGetEncryptedSecretShare(int *errStatus, char *errString, uint8_t *en
     gen_session_key(skey, pub_keyB, common_key);
     char *s_share[ECDSA_SKEY_LEN];;
 
-    if (calc_secret_share(decryptedDkgPoly, s_share, _t, _n, ind) != 0) {
+    if (calc_secret_share(getThreadLocalDecryptedDkgPoly(), s_share, _t, _n, ind) != 0) {
         *errStatus = -1;
         snprintf(errString, BUF_LEN, "\nt does not match poly degree\n");
         return;
@@ -683,14 +742,17 @@ void trustedGetEncryptedSecretShare(int *errStatus, char *errString, uint8_t *en
     strncpy(result_str + strlen(pub_key_x) + strlen(pub_key_y), pub_key_y, strlen(pub_key_y));
 }
 
-void trustedComplaintResponse(int *errStatus, char *errString, uint8_t *encryptedDHKey, uint8_t *encrypted_dkg_secret,
-                              uint32_t *dec_len,
-                              char *DH_key, char *s_shareG2, uint8_t _t, uint8_t _n, uint8_t ind1) {
+void trustedComplaintResponse(int *errStatus, char *errString, uint8_t *encrypted_dkg_secret,
+                              uint32_t *dec_len, char *s_shareG2, uint8_t _t, uint8_t _n, uint8_t ind1) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_dkg_secret);
+    CHECK_STATE(s_shareG2);
+    CHECK_STATE(_t <= _n);
+    CHECK_STATE(_n > 0);
+
     char decrypted_dkg_secret[DKG_BUFER_LENGTH];
-    uint32_t decr_len;
-    trustedDecryptDkgSecret(errStatus, errString, encrypted_dkg_secret, (uint8_t *) decrypted_dkg_secret, &decr_len);
+    trustedDecryptDkgSecret(errStatus, errString, encrypted_dkg_secret, (uint8_t *) decrypted_dkg_secret, dec_len);
     if (*errStatus != 0) {
         snprintf(errString, BUF_LEN, "sgx_unseal_data - encrypted_dkg_secret failed with status %d", *errStatus);
         return;
@@ -703,6 +765,11 @@ void trustedDkgVerify(int *errStatus, char *errString, const char *public_shares
                       uint8_t *encryptedPrivateKey, uint64_t key_len, unsigned _t, int _ind, int *result) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(public_shares);
+    CHECK_STATE(s_share);
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(_t);
+
     char skey[ECDSA_SKEY_LEN];
     sgx_status_t status = sgx_unseal_data(
             (const sgx_sealed_data_t *) encryptedPrivateKey, NULL, 0, (uint8_t *) skey, &key_len);
@@ -753,6 +820,15 @@ void trustedCreateBlsKey(int *errStatus, char *errString, const char *s_shares,
                          uint32_t *enc_bls_key_len) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(s_shares);
+    CHECK_STATE(encr_bls_key);
+
+    CHECK_STATE(s_shares);
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(encr_bls_key);
+
+
     char skey[ECDSA_SKEY_LEN];
     sgx_status_t status = sgx_unseal_data(
             (const sgx_sealed_data_t *) encryptedPrivateKey, NULL, 0, (uint8_t *) skey, &key_len);
@@ -845,6 +921,13 @@ void trustedGetBlsPubKey(int *errStatus, char *errString, uint8_t *encryptedPriv
                          char *bls_pub_key) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(bls_pub_key);
+
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(bls_pub_key);
+
+
     char skey_hex[ECDSA_SKEY_LEN];
 
     uint32_t len = key_len;
@@ -868,6 +951,12 @@ void trustedGenerateSEK(int *errStatus, char *errString,
                         uint8_t *encrypted_SEK, uint32_t *enc_len, char *SEK_hex) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_SEK);
+    CHECK_STATE(SEK_hex);
+
+    CHECK_STATE(encrypted_SEK);
+    CHECK_STATE(SEK_hex);
+
     uint8_t SEK_raw[SGX_AESGCM_KEY_SIZE];
     sgx_read_rand(SEK_raw, SGX_AESGCM_KEY_SIZE);
 
@@ -894,6 +983,9 @@ void trustedGenerateSEK(int *errStatus, char *errString,
 void trustedSetSEK(int *errStatus, char *errString, uint8_t *encrypted_SEK, uint64_t encr_len) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_SEK);
+
+
     uint8_t aes_key_hex[SGX_AESGCM_KEY_SIZE * 2];
     memset(aes_key_hex, 0, SGX_AESGCM_KEY_SIZE * 2);
 
@@ -913,6 +1005,9 @@ void trustedSetSEK_backup(int *errStatus, char *errString,
                           uint8_t *encrypted_SEK, uint32_t *enc_len, const char *SEK_hex) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_SEK);
+    CHECK_STATE(SEK_hex);
+
     uint64_t len;
     hex2carray(SEK_hex, &len, (uint8_t *) AES_key);
 
@@ -932,6 +1027,8 @@ void trustedSetSEK_backup(int *errStatus, char *errString,
 void trustedGenerateEcdsaKeyAES(int *errStatus, char *errString,
                                 uint8_t *encryptedPrivateKey, uint32_t *enc_len, char *pub_key_x, char *pub_key_y) {
     LOG_DEBUG(__FUNCTION__);
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(pub_key_x); CHECK_STATE(pub_key_y);
 
     domain_parameters curve = domain_parameters_init();
     domain_parameters_load_curve(curve, secp256k1);
@@ -972,6 +1069,7 @@ void trustedGenerateEcdsaKeyAES(int *errStatus, char *errString,
         pub_key_y[i] = '0';
     }
     strncpy(pub_key_y + n_zeroes, arr_y, 1024 - n_zeroes);
+
     char skey_str[ECDSA_SKEY_LEN];
     char arr_skey_str[mpz_sizeinbase(skey, ECDSA_SKEY_BASE) + 2];
     mpz_get_str(arr_skey_str, ECDSA_SKEY_BASE, skey);
@@ -983,7 +1081,7 @@ void trustedGenerateEcdsaKeyAES(int *errStatus, char *errString,
     skey_str[ECDSA_SKEY_LEN - 1] = 0;
     snprintf(errString, BUF_LEN, "skey len is %d\n", strlen(skey_str));
 
-    int stat = AES_encrypt(skey_str, encryptedPrivateKey);
+    int stat = AES_encrypt(skey_str, encryptedPrivateKey, BUF_LEN);
 
     if (stat != 0) {
         snprintf(errString, BUF_LEN, "ecdsa private key encryption failed");
@@ -998,9 +1096,7 @@ void trustedGenerateEcdsaKeyAES(int *errStatus, char *errString,
 
     *enc_len = strlen(skey_str) + SGX_AESGCM_MAC_SIZE + SGX_AESGCM_IV_SIZE;
 
-
-    stat = AES_decrypt(encryptedPrivateKey, *enc_len, skey_str);
-
+    stat = AES_decrypt(encryptedPrivateKey, *enc_len, skey_str, ECDSA_SKEY_LEN);
 
     if (stat != 0) {
         snprintf(errString + 19 + strlen(skey_str), BUF_LEN, "ecdsa private key decr failed with status %d", stat);
@@ -1022,12 +1118,15 @@ void trustedGetPublicEcdsaKeyAES(int *errStatus, char *errString,
                                  uint8_t *encryptedPrivateKey, uint32_t enc_len, char *pub_key_x, char *pub_key_y) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(pub_key_x); CHECK_STATE(pub_key_y);
+
     domain_parameters curve = domain_parameters_init();
     domain_parameters_load_curve(curve, secp256k1);
 
     char skey[ECDSA_SKEY_LEN];
 
-    int status = AES_decrypt(encryptedPrivateKey, enc_len, skey);
+    int status = AES_decrypt(encryptedPrivateKey, enc_len, skey, ECDSA_SKEY_LEN);
     skey[enc_len - SGX_AESGCM_MAC_SIZE - SGX_AESGCM_IV_SIZE] = '\0';
 
     if (status != 0) {
@@ -1107,6 +1206,11 @@ void trustedEcdsaSignAES(int *errStatus, char *errString, uint8_t *encryptedPriv
                          unsigned char *hash, char *sigR, char *sigS, uint8_t *sig_v, int base) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(hash);
+    CHECK_STATE(sigR);
+    CHECK_STATE(sigS);
+
     if (!ecdsaCurve) {
         ecdsaCurve = domain_parameters_init();
         domain_parameters_load_curve(ecdsaCurve, secp256k1);
@@ -1115,7 +1219,7 @@ void trustedEcdsaSignAES(int *errStatus, char *errString, uint8_t *encryptedPriv
 
     char skey[ECDSA_SKEY_LEN];
 
-    int status = AES_decrypt(encryptedPrivateKey, enc_len, skey);
+    int status = AES_decrypt(encryptedPrivateKey, enc_len, skey, ECDSA_SKEY_LEN);
 
     if (status != 0) {
         *errStatus = status;
@@ -1199,13 +1303,16 @@ void trustedEncryptKeyAES(int *errStatus, char *errString, const char *key,
                           uint8_t *encryptedPrivateKey, uint32_t *enc_len) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(key);
+    CHECK_STATE(encryptedPrivateKey);
+
     *errStatus = UNKNOWN_ERROR;
 
     memset(errString, 0, BUF_LEN);
 
     memset(encryptedPrivateKey, 0, BUF_LEN);
 
-    int stat = AES_encrypt(key, encryptedPrivateKey);
+    int stat = AES_encrypt(key, encryptedPrivateKey, BUF_LEN);
     if (stat != 0) {
         *errStatus = stat;
         snprintf(errString, BUF_LEN, "AES encrypt failed with status %d", stat);
@@ -1217,7 +1324,7 @@ void trustedEncryptKeyAES(int *errStatus, char *errString, const char *key,
     char decryptedKey[BUF_LEN];
     memset(decryptedKey, 0, BUF_LEN);
 
-    stat = AES_decrypt(encryptedPrivateKey, *enc_len, decryptedKey);
+    stat = AES_decrypt(encryptedPrivateKey, *enc_len, decryptedKey, BUF_LEN);
 
     if (stat != 0) {
         *errStatus = stat;
@@ -1246,9 +1353,13 @@ void trustedDecryptKeyAES(int *errStatus, char *errString, uint8_t *encryptedPri
                           uint32_t enc_len, char *key) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(key);
+
+
     *errStatus = -9;
 
-    int status = AES_decrypt(encryptedPrivateKey, enc_len, key);
+    int status = AES_decrypt(encryptedPrivateKey, enc_len, key, 3072);
 
     if (status != 0) {
         *errStatus = status;
@@ -1274,12 +1385,17 @@ void trustedBlsSignMessageAES(int *errStatus, char *errString, uint8_t *encrypte
                               char *_hashY, char *signature) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(_hashX);
+    CHECK_STATE(_hashY);
+    CHECK_STATE(signature);
+
     char key[BUF_LEN];
     memset(key, 0, BUF_LEN);
     char sig[BUF_LEN];
     memset(sig, 0, BUF_LEN);
 
-    int stat = AES_decrypt(encryptedPrivateKey, enc_len, key);
+    int stat = AES_decrypt(encryptedPrivateKey, enc_len, key, BUF_LEN);
 
     if (stat != 0) {
         *errStatus = stat;
@@ -1301,6 +1417,9 @@ void
 trustedGenDkgSecretAES(int *errStatus, char *errString, uint8_t *encrypted_dkg_secret, uint32_t *enc_len, size_t _t) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_dkg_secret);
+
+
     char dkg_secret[DKG_BUFER_LENGTH];
     memset(dkg_secret, 0, DKG_BUFER_LENGTH);
 
@@ -1309,7 +1428,7 @@ trustedGenDkgSecretAES(int *errStatus, char *errString, uint8_t *encrypted_dkg_s
         return;
     }
 
-    int status = AES_encrypt(dkg_secret, encrypted_dkg_secret);
+    int status = AES_encrypt(dkg_secret, encrypted_dkg_secret, 3 * BUF_LEN);
 
     if (status != SGX_SUCCESS) {
         snprintf(errString, BUF_LEN, "SGX AES encrypt DKG poly failed");
@@ -1322,7 +1441,8 @@ trustedGenDkgSecretAES(int *errStatus, char *errString, uint8_t *encrypted_dkg_s
     char decr_dkg_secret[DKG_BUFER_LENGTH];
     memset(decr_dkg_secret, 0, DKG_BUFER_LENGTH);
 
-    status = AES_decrypt(encrypted_dkg_secret, *enc_len, decr_dkg_secret);
+    status = AES_decrypt(encrypted_dkg_secret, *enc_len, decr_dkg_secret,
+                         DKG_BUFER_LENGTH);
     if (status != SGX_SUCCESS) {
         snprintf(errString, BUF_LEN, "aes decrypt dkg poly failed");
         *errStatus = status;
@@ -1342,7 +1462,11 @@ trustedDecryptDkgSecretAES(int *errStatus, char *errString, uint8_t *encrypted_d
                            uint32_t *dec_len) {
     LOG_DEBUG(__FUNCTION__);
 
-    int status = AES_decrypt(encrypted_dkg_secret, *dec_len, (char *) decrypted_dkg_secret);
+    CHECK_STATE(encrypted_dkg_secret);
+    CHECK_STATE(decrypted_dkg_secret);
+
+    int status = AES_decrypt(encrypted_dkg_secret, *dec_len, (char *) decrypted_dkg_secret,
+                             3072);
 
     if (status != SGX_SUCCESS) {
         snprintf(errString, BUF_LEN, "aes decrypt data - encrypted_dkg_secret failed with status %d", status);
@@ -1351,11 +1475,15 @@ trustedDecryptDkgSecretAES(int *errStatus, char *errString, uint8_t *encrypted_d
     }
 }
 
+
 void trustedSetEncryptedDkgPolyAES(int *errStatus, char *errString, uint8_t *encrypted_poly, uint64_t *enc_len) {
     LOG_DEBUG(__FUNCTION__);
 
-    memset(decryptedDkgPoly, 0, DKG_BUFER_LENGTH);
-    int status = AES_decrypt(encrypted_poly, *enc_len, (char *) decryptedDkgPoly);
+    CHECK_STATE(encrypted_poly);
+
+    memset(getThreadLocalDecryptedDkgPoly(), 0, DKG_BUFER_LENGTH);
+    int status = AES_decrypt(encrypted_poly, *enc_len, (char *) getThreadLocalDecryptedDkgPoly(),
+                             DKG_BUFER_LENGTH);
 
     if (status != SGX_SUCCESS) {
         *errStatus = -1;
@@ -1367,6 +1495,12 @@ void trustedSetEncryptedDkgPolyAES(int *errStatus, char *errString, uint8_t *enc
 void trustedGetEncryptedSecretShareAES(int *errStatus, char *errString, uint8_t *encrypted_skey, uint32_t *dec_len,
                                        char *result_str, char *s_shareG2, char *pub_keyB, uint8_t _t, uint8_t _n,
                                        uint8_t ind) {
+
+    CHECK_STATE(encrypted_skey);
+    CHECK_STATE(result_str);
+    CHECK_STATE(s_shareG2);
+    CHECK_STATE(pub_keyB);
+
     LOG_DEBUG(__FUNCTION__);
 
     char skey[ECDSA_SKEY_LEN];
@@ -1383,7 +1517,7 @@ void trustedGetEncryptedSecretShareAES(int *errStatus, char *errString, uint8_t
         return;
     }
 
-    int status = AES_decrypt(encrypted_skey, enc_len, skey);
+    int status = AES_decrypt(encrypted_skey, enc_len, skey, ECDSA_SKEY_LEN);
     skey[ECDSA_SKEY_LEN - 1] = 0;
 
     if (status != SGX_SUCCESS) {
@@ -1400,7 +1534,7 @@ void trustedGetEncryptedSecretShareAES(int *errStatus, char *errString, uint8_t
 
     char *s_share[ECDSA_SKEY_LEN];
 
-    if (calc_secret_share(decryptedDkgPoly, s_share, _t, _n, ind) != 0) {
+    if (calc_secret_share(getThreadLocalDecryptedDkgPoly(), s_share, _t, _n, ind) != 0) {
         *errStatus = -1;
 
         snprintf(errString, BUF_LEN, "calc secret share failed");
@@ -1431,10 +1565,15 @@ void trustedGetPublicSharesAES(int *errStatus, char *errString, uint8_t *encrypt
                                unsigned _t, unsigned _n) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(encrypted_dkg_secret);
+    CHECK_STATE(public_shares);
+    CHECK_STATE(_t <= _n && _n > 0)
+
     char *decrypted_dkg_secret = (char *) calloc(DKG_MAX_SEALED_LEN, 1);
     memset(decrypted_dkg_secret, 0, DKG_MAX_SEALED_LEN);
 
-    int status = AES_decrypt(encrypted_dkg_secret, enc_len, decrypted_dkg_secret);
+    int status = AES_decrypt(encrypted_dkg_secret, enc_len, decrypted_dkg_secret,
+                             DKG_MAX_SEALED_LEN);
 
     if (status != SGX_SUCCESS) {
         snprintf(errString, BUF_LEN, "aes decrypt data - encrypted_dkg_secret failed with status %d", status);
@@ -1457,9 +1596,14 @@ void trustedDkgVerifyAES(int *errStatus, char *errString, const char *public_sha
                          uint8_t *encryptedPrivateKey, uint64_t enc_len, unsigned _t, int _ind, int *result) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(public_shares);
+    CHECK_STATE(s_share);
+    CHECK_STATE(encryptedPrivateKey);
+
     char skey[ECDSA_SKEY_LEN];
     memset(skey, 0, ECDSA_SKEY_LEN);
-    int status = AES_decrypt(encryptedPrivateKey, enc_len, skey);
+
+    int status = AES_decrypt(encryptedPrivateKey, enc_len, skey, ECDSA_SKEY_LEN);
 
     if (status != SGX_SUCCESS) {
         snprintf(errString, BUF_LEN, "AES_decrypt failed (in trustedDkgVerifyAES) with status %d", status);
@@ -1511,8 +1655,13 @@ void trustedCreateBlsKeyAES(int *errStatus, char *errString, const char *s_share
                             uint32_t *enc_bls_key_len) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(s_shares);
+    CHECK_STATE(encryptedPrivateKey);
+    CHECK_STATE(encr_bls_key);
+
+
     char skey[ECDSA_SKEY_LEN];
-    int status = AES_decrypt(encryptedPrivateKey, key_len, skey);
+    int status = AES_decrypt(encryptedPrivateKey, key_len, skey, ECDSA_SKEY_LEN);
     if (status != SGX_SUCCESS) {
         *errStatus = status;
         snprintf(errString, BUF_LEN, "aes decrypt failed with status %d", status);
@@ -1599,7 +1748,7 @@ void trustedCreateBlsKeyAES(int *errStatus, char *errString, const char *s_share
     strncpy(key_share + n_zeroes, arr_skey_str, 65 - n_zeroes);
     key_share[BLS_KEY_LENGTH - 1] = 0;
 
-    status = AES_encrypt(key_share, encr_bls_key);
+    status = AES_encrypt(key_share, encr_bls_key, BUF_LEN);
 
     if (status != SGX_SUCCESS) {
         *errStatus = -1;
@@ -1623,9 +1772,12 @@ trustedGetBlsPubKeyAES(int *errStatus, char *errString, uint8_t *encryptedPrivat
                        char *bls_pub_key) {
     LOG_DEBUG(__FUNCTION__);
 
+    CHECK_STATE(bls_pub_key);
+    CHECK_STATE(encryptedPrivateKey);
+
     char skey_hex[ECDSA_SKEY_LEN];
 
-    int status = AES_decrypt(encryptedPrivateKey, key_len, skey_hex);
+    int status = AES_decrypt(encryptedPrivateKey, key_len, skey_hex, ECDSA_SKEY_LEN);
     if (status != SGX_SUCCESS) {
         *errStatus = 1;
         snprintf(errString, BUF_LEN, "aes_decrypt failed with status %d", status);

secure_enclave/secure_enclave.config.xml

 <EnclaveConfiguration>
  <ProdID>0</ProdID>
  <ISVSVN>0</ISVSVN>
- <StackMaxSize>0x100000</StackMaxSize>
- <HeapMaxSize>0x1000000</HeapMaxSize>
- <TCSNum>16</TCSNum>
- <TCSMaxNum>16</TCSMaxNum>
- <TCSPolicy>1</TCSPolicy>
+ <StackMaxSize>0x1000000</StackMaxSize>
+ <HeapMaxSize>0x100000000</HeapMaxSize>
+ <TCSNum>128</TCSNum>
+ <TCSMaxNum>128</TCSMaxNum>
+ <TCSMinPool>128</TCSMinPool>
+ <TCSPolicy>0</TCSPolicy>
  <!-- Recommend changing 'DisableDebug' to 1 to make the enclave undebuggable for enclave release -->
  <DisableDebug>0</DisableDebug>
  <MiscSelect>0</MiscSelect>

secure_enclave/secure_enclave.edl

@@ -10,32 +10,17 @@ enclave {
 
 		public void trustedEnclaveInit(uint32_t _logLevel);
 
-		public void trustedEMpzAdd(
-			[user_check] mpz_t *c, [user_check] mpz_t *a, [user_check] mpz_t *b
-		);
-
-		public void trustedEMpzMul(
-			[user_check] mpz_t *c, [user_check] mpz_t *a, [user_check] mpz_t *b
-		);
-
-		public void trustedEMpzDiv(
-			[user_check] mpz_t *c, [user_check] mpz_t *a, [user_check] mpz_t *b
-		);
-
-		public void trustedEMpfDiv(
-			[user_check] mpf_t *c, [user_check] mpf_t *a, [user_check] mpf_t *b
-		);
 
 		public void trustedGenerateEcdsaKey (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [out, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
-                                [user_check] uint32_t *enc_len,
+                                [out] uint32_t *enc_len,
                                 [out, count = SMALL_BUF_SIZE] char * pub_key_x,
                                 [out, count = SMALL_BUF_SIZE] char * pub_key_y);
 
 		public void trustedGetPublicEcdsaKey (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint32_t dec_len,
@@ -43,53 +28,53 @@ enclave {
                                 [out, count = SMALL_BUF_SIZE] char * pub_key_y);
 
 		public void trustedEncryptKey (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] const char* key,
                                 [out, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
-                                [user_check] uint32_t *enc_len);
+                                [out] uint32_t *enc_len);
 
 		public void trustedDecryptKey (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint32_t enc_len,
                                 [out, count = SMALL_BUF_SIZE] char* key );
 
 		public void trustedBlsSignMessage (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint32_t enc_len,
-                                [in, count = SMALL_BUF_SIZE] char* hashX ,
-                                [in, count = SMALL_BUF_SIZE] char* hashY ,
+                                [in, string] char* hashX ,
+                                [in, string] char* hashY ,
                                 [out, count = SMALL_BUF_SIZE] char* signature);
 
         public void trustedGenDkgSecret (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [out, count = 3050] uint8_t* encrypted_dkg_secret,
-                                [user_check] uint32_t * enc_len,
+                                [out] uint32_t * enc_len,
                                 size_t _t);
 
         public void trustedDecryptDkgSecret (
-                            	[user_check] int *errStatus,
+                            	[out] int *errStatus,
                             	[out, count = SMALL_BUF_SIZE] char* err_string,
                             	[in, count = 3050] uint8_t* encrypted_dkg_secret,
                             	[out, count = 2490] uint8_t* decrypted_dkg_secret,
-                            	[user_check] uint32_t* dec_len);
+                            	[out] uint32_t* dec_len);
 
         public void trustedGetSecretShares (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = 3050] uint8_t* encrypted_dkg_secret,
-                                [user_check] uint32_t* dec_len,
+                                [out] uint32_t* dec_len,
                                 [out, count = 2490] char* secret_shares,
                                 unsigned _t,
                                 unsigned _n);
 
         public void trustedGetPublicShares (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = 3050] uint8_t* encrypted_dkg_secret,
                                 uint32_t enc_len,
@@ -98,101 +83,99 @@ enclave {
                                 unsigned _n);
 
         public void trustedEcdsaSign(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint32_t enc_len,
-                                [in, count = SMALL_BUF_SIZE] unsigned char* hash,
+                                [in, string] unsigned char* hash,
                                 [out, count = SMALL_BUF_SIZE] char* sig_r,
                                 [out, count = SMALL_BUF_SIZE] char* sig_s,
-                                [user_check] uint8_t* sig_v,
+                                [out] uint8_t* sig_v,
                                 int base);
 
-        public void trustedSetEncryptedDkgPoly( [user_check] int *errStatus,
+        public void trustedSetEncryptedDkgPoly( [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = 3050] uint8_t* encrypted_poly);
 
         public void trustedGetEncryptedSecretShare(
-                                [user_check]int *errStatus,
+                                [out]int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char *err_string,
                                 [out, count = SMALL_BUF_SIZE] uint8_t *encrypted_skey,
-                                [user_check] uint32_t* dec_len,
+                                [out] uint32_t* dec_len,
                                 [out, count = 193] char* result_str,
                                 [out, count = 320] char* s_shareG2,
-                                [in, count = 129] char* pub_keyB,
+                                [in, string] char* pub_keyB,
                                 uint8_t _t,
                                 uint8_t _n,
                                 uint8_t ind);
 
         public void trustedDkgVerify(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
-                                [in, count = 8193] const char* public_shares,
-                                [in, count = 193] const char* s_share,
+                                [in, string] const char* public_shares,
+                                [in, string] const char* s_share,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint64_t key_len,
                                 unsigned _t,
                                 int _ind,
-                                [user_check] int* result);
+                                [out] int* result);
 
         public void trustedCreateBlsKey(
-                                [user_check]int *errStatus,
+                                [out]int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
-                                [in, count = 6145] const char* s_shares,
+                                [in, string] const char* s_shares,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint64_t key_len,
                                 [out, count = SMALL_BUF_SIZE] uint8_t * encr_bls_key,
-                                [user_check] uint32_t *enc_bls_key_len);
+                                [out] uint32_t *enc_bls_key_len);
 
         public void trustedGetBlsPubKey(
-                                [user_check]int *errStatus,
+                                [out]int *errStatus,
                                 [out, count = SMALL_BUF_SIZE]  char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint64_t key_len,
                                 [out, count = 320] char* bls_pub_key);
 
         public void trustedComplaintResponse(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE]  char* err_string,
-                                [in, count = SMALL_BUF_SIZE] uint8_t *encryptedDHKey,
                                 [in, count = 3050] uint8_t *encrypted_dkg_secret,
-                                [user_check] uint32_t* dec_len,
-                                [out, count = 65] char* DH_key,
+                                [out] uint32_t* dec_len,
                                 [out, count = 320] char* s_shareG2,
                                 uint8_t _t,
                                 uint8_t _n,
                                 uint8_t ind1);
 
         public void trustedGenerateSEK(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char *err_string,
                                 [out, count = SMALL_BUF_SIZE] uint8_t *encrypted_SEK,
-                                [user_check] uint32_t *enc_len,
+                                [out] uint32_t *enc_len,
                                 [out, count = 65] char* hex_SEK);
 
         public void trustedSetSEK(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char *err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t *encrypted_SEK,
                                 uint64_t encr_len);
 
         public void trustedSetSEK_backup(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char *err_string,
                                 [out, count = SMALL_BUF_SIZE] uint8_t *encrypted_SEK,
-                                [user_check] uint32_t *enc_len,
-                                [in, count = 65] const char* SEK_hex);
+                                [out] uint32_t *enc_len,
+                                [in, string] const char* SEK_hex);
 
         public void trustedGenerateEcdsaKeyAES (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
-                                [out, count = ECDSA_ENCR_LEN] uint8_t* encrypted_key,
-                                [user_check] uint32_t *enc_len,
+                                [out, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
+                                [out] uint32_t *enc_len,
                                 [out, count = SMALL_BUF_SIZE] char * pub_key_x,
                                 [out, count = SMALL_BUF_SIZE] char * pub_key_y);
 
         public void trustedGetPublicEcdsaKeyAES(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint32_t dec_len,
@@ -200,63 +183,63 @@ enclave {
                                 [out, count = SMALL_BUF_SIZE] char * pub_key_y);
 
         public void trustedEcdsaSignAES(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint32_t enc_len,
-                                [in, count = SMALL_BUF_SIZE] unsigned char* hash,
+                                [in, string] unsigned char* hash,
                                 [out, count = SMALL_BUF_SIZE] char* sig_r,
                                 [out, count = SMALL_BUF_SIZE] char* sig_s,
-                                [user_check] uint8_t* sig_v,
+                                [out] uint8_t* sig_v,
                                 int base);
 
         public void trustedEncryptKeyAES (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] const char* key,
                                 [out, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
-                                [user_check] uint32_t *enc_len);
+                                [out] uint32_t *enc_len);
 
         public void trustedDecryptKeyAES (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint32_t enc_len,
                                 [out, count = SMALL_BUF_SIZE] char* key );
 
         public void trustedGenDkgSecretAES (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
-                                [out, count = 3050] uint8_t* encrypted_dkg_secret,
-                                [user_check] uint32_t * enc_len, size_t _t);
+                                [out, count = 3072] uint8_t* encrypted_dkg_secret,
+                                [out] uint32_t * enc_len, size_t _t);
 
         public void trustedDecryptDkgSecretAES (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = 3050] uint8_t* encrypted_dkg_secret,
-                                [out, count = 2490] uint8_t* decrypted_dkg_secret,
+                                [out, count = 3072] uint8_t* decrypted_dkg_secret,
                                 [user_check] uint32_t* dec_len);
 
         public void trustedSetEncryptedDkgPolyAES(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = 3050] uint8_t* encrypted_poly,
                                 [user_check] uint64_t* enc_len);
 
         public void trustedGetEncryptedSecretShareAES(
-                                [user_check]int *errStatus,
+                                [out]int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char *err_string,
                                 [out, count = SMALL_BUF_SIZE] uint8_t *encrypted_skey,
-                                [user_check] uint32_t* dec_len,
+                                [out] uint32_t* dec_len,
                                 [out, count = 193] char* result_str,
                                 [out, count = 320] char* s_shareG2,
-                                [in, count = 129] char* pub_keyB,
+                                [in, string] char* pub_keyB,
                                 uint8_t _t,
                                 uint8_t _n,
                                 uint8_t ind);
 
         public void trustedGetPublicSharesAES(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = 3050] uint8_t* encrypted_dkg_secret,
                                 uint32_t enc_len,
@@ -265,36 +248,36 @@ enclave {
                                 unsigned _n);
 
         public void trustedDkgVerifyAES(
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
-                                [in, count = 8193] const char* public_shares,
-                                [in, count = 193] const char* s_share,
+                                [in, string] const char* public_shares,
+                                [in, string] const char* s_share,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint64_t key_len,
                                 unsigned _t,
                                 int _ind,
-                                [user_check] int* result);
+                                [out] int* result);
 
         public void trustedCreateBlsKeyAES(
-                                [user_check]int *errStatus,
+                                [out]int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = 6145] const char* s_shares,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint64_t key_len,
                                 [out, count = SMALL_BUF_SIZE] uint8_t * encr_bls_key,
-                                [user_check] uint32_t *enc_bls_key_len);
+                                [out] uint32_t *enc_bls_key_len);
 
         public void trustedBlsSignMessageAES (
-                                [user_check] int *errStatus,
+                                [out] int *errStatus,
                                 [out, count = SMALL_BUF_SIZE] char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint32_t enc_len,
-                                [in, count = SMALL_BUF_SIZE] char* hashX ,
-                                [in, count = SMALL_BUF_SIZE] char* hashY ,
+                                [in, string] char* hashX ,
+                                [in, string] char* hashY ,
                                 [out, count = SMALL_BUF_SIZE] char* signature);
 
         public void trustedGetBlsPubKeyAES(
-                                [user_check]int *errStatus,
+                                [out]int *errStatus,
                                 [out, count = SMALL_BUF_SIZE]  char* err_string,
                                 [in, count = SMALL_BUF_SIZE] uint8_t* encrypted_key,
                                 uint64_t key_len,

testw.cpp

@@ -342,11 +342,12 @@ TEST_CASE_METHOD(TestFixture, "DKG AES gen test", "[dkg-aes-gen]") {
     vector<char> secret(2490, 0);
     vector<char> errMsg1(BUF_LEN, 0);
 
-    status = trustedDecryptDkgSecretAES(eid, &errStatus, errMsg1.data(), encryptedDKGSecret.data(),
+    /*status = trustedDecryptDkgSecretAES(eid, &errStatus, errMsg1.data(), encryptedDKGSecret.data(),
                                         (uint8_t *) secret.data(), &encLen);
 
     REQUIRE(status == SGX_SUCCESS);
     REQUIRE(errStatus == SGX_SUCCESS);
+     */
 }
 
 TEST_CASE_METHOD(TestFixture, "DKG public shares test", "[dkg-pub-shares]") {