{"id":40819736,"url":"https://github.com/cc-api/full-disk-encryption","last_synced_at":"2026-01-21T21:46:49.346Z","repository":{"id":229968765,"uuid":"778080426","full_name":"cc-api/full-disk-encryption","owner":"cc-api","description":"Full disk encryption solution in the confidential computing environment","archived":false,"fork":false,"pushed_at":"2024-05-13T20:32:16.000Z","size":137,"stargazers_count":1,"open_issues_count":0,"forks_count":1,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-05-13T21:41:08.959Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cc-api.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-27T03:15:00.000Z","updated_at":"2024-05-13T20:32:21.000Z","dependencies_parsed_at":null,"dependency_job_id":"759c2fde-e3be-4815-8514-6c58d83b55bd","html_url":"https://github.com/cc-api/full-disk-encryption","commit_stats":null,"previous_names":["cc-api/full-disk-encryption"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/cc-api/full-disk-encryption","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cc-api%2Ffull-disk-encryption","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cc-api%2Ffull-disk-encryption/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cc-api%2Ffull-disk-encryption/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cc-api%2Ffull-disk-encryption/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cc-api","download_url":"https://codeload.github.com/cc-api/full-disk-encryption/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cc-api%2Ffull-disk-encryption/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28644149,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-21T21:29:11.980Z","status":"ssl_error","status_checked_at":"2026-01-21T21:24:31.872Z","response_time":86,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-21T21:46:48.648Z","updated_at":"2026-01-21T21:46:49.341Z","avatar_url":"https://github.com/cc-api.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TDX Full Disk Encryption\n\nFull disk encryption (FDE) is a security method for protecting sensitive\ndata by encrypting all data on a disk partition. FDE shall encrypt data\nautomatically to prevent unauthorized access.\nThis project is a FDE solution based on [Intel\u0026reg; Trust Domain\nExtensions(Intel TDX)](https://www.intel.com/content/www/us/en/developer/articles/technical/intel-trust-domain-extensions.html).\n\n## Architecture\n\n![](./docs/fde-arch.png)\n\n## Preparation\n\nWe build the Ubuntu 22.04 guest image on the Ubuntu 22.04 host, and validate it. If you work in other environment, please adapt scripts in the below sections carefully (not recommended).\n\n**Note: The default FDE solution is just a reference implementation. Both fde-agent and fde-image.sh depend on an available KBS (Key Broker Service). Otherwise they cannot work. Please modify fde-agent code to add KBS information before running the solution. The detail can be found in [retreive_key_from_kbs](https://github.com/cc-api/full-disk-encryption/blob/3c4325c7a6b4d2fe76aa0b873920bf981c46db41/src/key_broker.rs#L20).**\n\n### 1. Register a key\n\nThe `key` to encrypt the image disk is distributed by the KBS, besides, which will bind a unique `keyid` with the `key`. The `keyid` is the key's identifier in the KBS. Consult your KBS to get a pair of key and key_id.\n\n### 2. Build the fde-agent\n\nThe fde-agent is placed in the `FDE_DIR=attestaion/full-disk-encryption`.\n\nThe fde-agent is responsible for decrypting a guest image and mounting it as the rootfs. The fde-agent depends on dynamic libraries `libtdx-attest` and `libtdx-attest-dev` in `DCAP`. The `DCAP` can be downloaded from [official website](https://download.01.org/intel-sgx/sgx-dcap/). Please get the correct version of DCAP and install the libraries. Then build the fde-agent by the following commands.\n\n```\nmake clean -C ../full-disk-encryption\nmake -C ../full-disk-encryption\n```\n\n### 3. Create FDE image\n\nThere are several ways to create FDE image. The [wiki page](https://help.ubuntu.com/community/Full_Disk_Encryption_Howto_2019) in Ubuntu community provides a base knowledge. Besides, install fde-agent and initramfs-tools in this repo. Finally, append the option `cryptdevice` in the kernel command (refer [link](https://wiki.archlinux.org/title/dm-crypt/System_configuration)) and then update the Grub config.\n\n```\ncd ${FDE_DIR}/attestation/full-disk-enryption/tools/image\n./fde-image.sh -k $KEY -i $KEY_ID -d ${TDX_REPO_LOCAL}\n```\n\nThe `KEY=key` and `KEY_ID=keyid` are retrieved in step 1. The `TDX_REPO_LOCAL` is built from `tdx-tools`.\n\n### 4. Enroll variables to OVMF\n\nInstall [ovmfkeyenroll](/tools/ovmfkeyenroll/) tool.\n\n```\npip3 install ovmfkeyenroll\n```\n\nEnroll Key Broker Service (KBS) information to OVMF\n\n1. KBS URL\n\n```\nNAME=\"KBSURL\"\nGUID=\"0d9b4a60-e0bf-4a66-b9b1-db1b98f87770\"\nDATA=\"url.txt\"\npython3 tools/image/enroll_vars.py -i OVMF.fd -o OVMF_FDE.fd -n $NAME -g $GUID -d $DATA\n```\n\n2. KBS Certificate\n\n```\nNAME=\"KBSCert\"\nGUID=\"d2bf05a0-f7f8-41b6-b0ff-ad1a31c34d37\"\nDATA=\"cert.cer\"\npython3 tools/image/enroll_vars.py -i OVMF_FDE.fd -o OVMF_FDE.fd -n $NAME -g $GUID -d $DATA\n```\n\n3. KBS User Data\n\n```\nNAME=\"KBSUserData\"\nGUID=\"732284dd-70c4-472a-aa45-1ffda02caf74\"\nDATA=\"userdata.txt\"\npython3 tools/image/enroll_vars.py -i OVMF_FDE.fd -o OVMF_FDE.fd -n $NAME -g $GUID -d $DATA\n```\n\nIt is recommended to use a json structure to save the userdata, at least including the `keyid` item retrieved in step 1. You can customize the enrolled data, detail in `src/ovmf_var.rs`\n\n```\n# cat userdata.txt\n{\n    \"keyid\":\"sth\"\n}\n```\n\n### TDX tools\n\nThe script `start-qemu.sh` helps launch a TDX guest from an encrypted guest image built through above steps.\n\n## Validation\n\nLaunch a tdvm guest by the following command.\n\n```\nOVMF_PATH=/path/to/OVMF\nIMAGE_PATH=/path/to/image\n\nstart-qemu.sh \\\n    -b grub \\\n    -q tdvmcall \\\n    -o ${OVMF_PATH} \\\n    -i ${IMAGE_PATH}\n```\n\nVerify the encryption status by running the command in the tdvm guest.\n\n```\nblkid\n```\n\nThe TYPE of encrypted partition should be `crypto_LUKS`\n\n```\n/dev/vda1: UUID=\"79c64ac3-c2c2-479b-bbd8-ea9c7d5cf29f\" LABEL=\"cloudimg-rootfs-enc\" TYPE=\"crypto_LUKS\"\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcc-api%2Ffull-disk-encryption","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcc-api%2Ffull-disk-encryption","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcc-api%2Ffull-disk-encryption/lists"}