Encrypted data key management

1. A method comprising:

receiving an encrypted file system key associated with a first secure enclave;

receiving a request from a second secure enclave to access a file system associated with the encrypted file system key;

receiving a policy associated with the encrypted file system key;

determining whether the second secure enclave satisfies one or more conditions associated with the policy;

in response to receiving the request and further in response to determining that the second secure enclave satisfies the one or more conditions, decrypting the encrypted file system key with a private cryptographic key associated with an enclave manager to obtain a file system key, wherein the private cryptographic key corresponds to a public key included in an enclave manager key wrapping certificate, and wherein the enclave manager key wrapping certificate is provided to the first secure enclave as a result of a first attestation operation performed with the enclave manager;

receiving, from the second secure enclave, an application key wrapping certificate;

encrypting, by a processing device, the file system key based on a public cryptographic key associated with the second secure enclave to generate a re-encrypted file system key, wherein the public cryptographic key is from the application key wrapping certificate; and

providing the re-encrypted file system key to the second secure enclave.

2. The method of claim 1 , wherein the re-encrypted file system key is used to utilize the file system at the second secure enclave.

3. The method of claim 1 , further comprising:

verifying a signature of the second secure enclave in response to receiving the request, wherein the decrypting of the encrypted file system key is further in response to verifying the signature of the second secure enclave.

4. The method of claim 1 , further comprising:

signing the re-encrypted file system key with a private key that is associated with the enclave manager, wherein re-encrypted file system key that is signed is provided to the second secure enclave.

5. The method of claim 1 , wherein the encrypted file system key associated with the first secure enclave corresponds to a particular file system key that is derived based on a first secure enclave key of the first secure enclave.

6. The method of claim 5 , wherein the particular file system key is an internal cryptographic key of a processor that is providing the first secure enclave and is not accessible by the second secure enclave.

7. A system comprising:

a memory; and

a processing device, operatively coupled with the memory, to:

receive an encrypted file system key associated with a first secure enclave;

receive a request from a second secure enclave to access a file system associated with the encrypted file system key;

receive a policy associated with the encrypted file system key;

determine whether the second secure enclave satisfies one or more conditions associated with the policy;

in response to receiving the request and further in response to determining that the second secure enclave satisfies the one or more conditions, decrypt the encrypted file system key with a private cryptographic key associated with an enclave manager to obtain a file system key, wherein the private cryptographic key corresponds to a public key included in an enclave manager key wrapping certificate, and wherein the enclave manager key wrapping certificate is provided to the first secure enclave as a result of a first attestation operation performed with the enclave manager;

receive, from the second secure enclave, an application key wrapping certificate;

encrypt the file system key based on a public cryptographic key associated with the second secure enclave to generate a re-encrypted file system key, wherein the public cryptographic key is from the application key wrapping certificate; and

provide the re-encrypted file system key to the second secure enclave.

8. The system of claim 7 , wherein the re-encrypted file system key is used to utilize the file system at the second secure enclave.

9. The system of claim 7 , wherein the processing device is further to:

verify a signature of the second secure enclave in response to receiving the request, wherein the decrypting of the encrypted file system key is further in response to verifying the signature of the second secure enclave.

10. The system of claim 7 , wherein the one or more conditions are associated with an identification of an application provided by the second secure enclave.

11. The system of claim 7 , wherein the encrypted file system key associated with the first secure enclave corresponds to a particular file system key that is derived based on a first secure enclave key of the first secure enclave.

12. The system of claim 11 , wherein the particular file system key is an internal cryptographic key of a processor that is providing the first secure enclave and is not accessible by the second secure enclave.

13. A non-transitory computer readable medium comprising data that, when accessed by a processing device, cause the processing device to perform operations comprising:

receiving an encrypted file system key associated with a first secure enclave;

receiving a request from a second secure enclave to access a file system associated with the encrypted file system key;

receiving a policy associated with the encrypted file system key;

determining whether the second secure enclave satisfies one or more conditions associated with the policy;

in response to receiving the request and further in response to determining that the second secure enclave satisfies the one or more conditions, decrypting the encrypted file system key with a private cryptographic key associated with an enclave manager to obtain a file system key, wherein the private cryptographic key corresponds to a public key included in an enclave manager key wrapping certificate, and wherein the enclave manager key wrapping certificate is provided to the first secure enclave as a result of a first attestation operation performed with the enclave manager;

receiving, from the second secure enclave, an application key wrapping certificate;

encrypting the file system key based on a public cryptographic key associated with the second secure enclave to generate a re-encrypted file system key, wherein the public cryptographic key is from the application key wrapping certificate; and

providing the re-encrypted file system key to the second secure enclave.

14. The non-transitory computer readable medium of claim 13 , wherein the re-encrypted file system key is used to utilize the file system at the second secure enclave.

15. The non-transitory computer readable medium of claim 13 , the operations further comprising:

verifying a signature of the second secure enclave in response to receiving the request, wherein the decrypting of the encrypted file system key is further in response to verifying the signature of the second secure enclave.

16. The non-transitory computer readable medium of claim 13 , wherein the one or more conditions are associated with an identification of an application provided by the second secure enclave.

17. The non-transitory computer readable medium of claim 13 , wherein the encrypted file system key associated with the first secure enclave corresponds to a particular file system key that is derived based on a first secure enclave key of the first secure enclave.