Key vault enclave

1. A key vault method, comprising:

sending a vault attestation report of a key vault enclave to a vault client, wherein the vault client is an enclave, and the vault client and key vault enclave are hosted on separate native enclave platforms;

receiving, at the key vault enclave, a client attestation report of the vault client;

receiving, at the key vault enclave, an indication of a key use policy, wherein the key use policy specifies that one or more keys should never leave the key vault and should never be provided to any vault client;

generating a key by the key vault enclave, wherein the key is included among the one or more keys;

securely storing the key at the key vault enclave according to the key use policy;

receiving, at the key vault enclave, an encrypted data buffer from the vault client in response to the vault attestation report of the key vault enclave being sent to the vault client;

decrypting the encrypted data buffer with the key by the key vault enclave; and

sending the decrypted data buffer to the vault client by the key vault enclave via a secure communications channel in response to the client attestation report of the vault client being received at the key vault enclave.

2. A key vault method, comprising:

receiving, at a key vault enclave, a client attestation report of a vault client, wherein the vault client is an enclave, and wherein the vault client and key vault enclave are hosted on different native enclave platforms;

verifying integrity of the client attestation report by verifying a signature of the client attestation report with a public key associated with the native enclave platform of the vault client and not associated with the native enclave platform of the key vault enclave;

securely storing a key for an encryption system within the key vault enclave according to a key use policy;

sending a vault attestation report of the key vault enclave to the vault client; and

performing an operation in the key vault enclave with the key in response to trust in the key vault enclave being established as a result of sending the vault attestation report, said performing the operation comprises:

receiving an identifier that identifies a key derivation function from the vault client; and

in response to trust in the vault client being established as a result of verifying the integrity of the client attestation report, deriving a new encryption key based on the key using the key derivation function that is identified by the identifier received from the vault client.

3. The key vault method of claim 2 , further comprising:

creating the vault attestation report with an identifier associated with a creator of the key vault enclave.

4. The key vault method of claim 2 , wherein the operation is storing the key, the operation comprising:

establishing a secure communications channel between the key vault enclave and the vault client; and

receiving the key and the key use policy from the vault client via the secure communications channel.

5. The key vault method of claim 2 , wherein the other new key is a vault-locked key:

wherein the key vault method further comprises:

receiving an indication of the key use policy from the vault client; and

wherein performing the operation comprises:

using the new encryption key to derive the other new key.

6. The key vault method of claim 2 , wherein performing the operation comprises:

receiving, at the key vault enclave, a client attestation report of the vault client;

establishing a secure communications channel between the key vault enclave and the vault client; and

sending the key to the vault client.

7. The key vault method of claim 2 , wherein performing the operation comprises:

establishing a secure communications channel between the key vault enclave and the vault client;

receiving an encrypted data buffer from the vault client;

decrypting the encrypted data buffer to produce a decrypted data buffer with the new encryption key; and

sending the decrypted data buffer to the vault client via the secure communications channel.

8. The key vault method of claim 2 , wherein performing the operation comprises:

establishing a secure communications channel between the key vault enclave and the vault client;

receiving a data buffer from the vault client via the secure communications channel;

encrypting the data buffer with the new encryption key to produce an encrypted data buffer; and

sending the encrypted data buffer to the vault client.

9. The key vault method of claim 2 , wherein performing the operation comprises:

receiving a data buffer from the vault client;

creating a signature of the data buffer with the new encryption key; and

sending the signature to the vault client.

10. The key vault method of claim 2 , wherein the key use policy indicates that the key is to be destroyed at a specified date or that a rate of operations using the key is to be limited.

11. The key vault method of claim 2 , further comprising:

using the new encryption key to sign information that is to be sent to the vault client.

12. The key vault method of claim 2 , further comprising:

using the new encryption key to derive another new key.

13. A system comprising at least a processor and memory storing thereon instructions that, when executed by the system, cause at least:

receiving, at a key vault enclave, a client attestation report of a vault client, wherein the vault client is an enclave, and wherein the vault client and key vault enclave are hosted on different native enclave platforms;

verifying integrity of the client attestation report by verifying a signature of the client attestation report with a public key associated with the native enclave platform of the vault client and not associated with the native enclave platform of the key vault enclave;

securely storing a key for an encryption system within the key vault enclave according to a key use policy in response to receipt of an indication of the key use policy from the vault client, the indication of the key use policy is a data structure specifying the key use policy or an identifier that is usable with a registry of key use policies, the key use policy specifies that the key is not to leave the key vault enclave and is not to be provided to vault clients;

sending a vault attestation report of the key vault enclave to the vault client; and

performing an operation in the key vault enclave with the key in response to trust in the key vault enclave being established as a result of the vault attestation report being sent to the vault client and further in response to trust in the vault client being established as a result of verifying the integrity of the client attestation report.

14. The system of claim 13 , wherein the instructions further cause at least:

creating the vault attestation report with an identifier associated with a creator of the key vault enclave.

15. The system of claim 13 , wherein the operation is creating a vault-locked key, and wherein the instructions further cause at least:

receiving the indication of the key use policy from the vault client; and

generating the key.

16. The system of claim 13 , wherein the operation is providing the key to the vault client, and wherein the instructions further cause at least:

receiving a client attestation report of the vault client to the key vault enclave;

establishing a secure communications channel between the key vault enclave and the vault client; and

sending the key to the vault client.

17. The system of claim 13 , wherein the operation is deriving a new key, and wherein the instructions further cause at least:

receiving an indication of a key derivation function from the vault client; and

deriving the new key from the key and the indicated key derivation function.

18. The system of claim 13 , wherein the operation is decrypting a data buffer, and wherein the instructions further cause at least:

establishing a secure communications channel between the key vault enclave and the vault client;

receiving an encrypted data buffer from the vault client;

decrypting the encrypted data buffer to produce a decrypted data buffer with the key; and

sending the decrypted data buffer to the vault client via the secure communications channel.

19. The system of claim 13 , wherein the operation is signing a data buffer, and wherein the instructions further cause at least

receiving the data buffer from the vault client;

creating a signature of the data buffer with the key; and

sending the signature to the vault client.

20. The system of claim 12 , wherein the key use policy indicates that the key is to be destroyed at a specified date or that a rate of operations using the key is to be limited.