[Soham Das (SohamDas2021)]

This PR introduces a complete Rust implementation of the VBS Enclave SDK for user-bound keys, along with a working sample application.

[Copilot]

Pull request overview

This PR introduces a complete Rust implementation of user-bound key functionality for the VBS Enclave SDK, enabling Windows Hello-protected encryption keys sealed to VBS enclaves.

Changes:

• New user-bound key SDK modules for both host (VTL0) and enclave (VTL1) with Windows Hello integration
• Complete working sample application demonstrating key creation, encryption, and decryption
• Build system updates including consolidated build script and improved enclave signing

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
rust/sdk/generate_codegen_for_workspace.ps1	Deleted legacy codegen script, consolidated into build.ps1
rust/sdk/generate_and_build_crates.ps1	Deleted legacy build script, replaced by new build.ps1
rust/sdk/crates/samples/userboundkey/userboundkey_sample.edl	EDL interface for sample's trusted/untrusted functions
rust/sdk/crates/samples/userboundkey/host/src/main.rs	Interactive host application with menu-driven interface
rust/sdk/crates/samples/userboundkey/host/src/edl_impls.rs	Host-side EDL untrusted function implementations
rust/sdk/crates/samples/userboundkey/enclave/src/lib.rs	Enclave entry point with SDK function exports
rust/sdk/crates/samples/userboundkey/enclave/src/edl_impls.rs	Enclave EDL trusted function implementations
rust/sdk/crates/samples/userboundkey/enclave/src/enclave_constants.rs	VBS enclave configuration constants
rust/sdk/crates/samples/userboundkey/build.ps1	Build script for sample with EDL generation and signing
rust/sdk/crates/samples/userboundkey/README.md	Comprehensive documentation with prerequisites and usage
rust/sdk/crates/libs/userboundkey.edl	EDL interface defining VTL0/VTL1 user-bound key operations
rust/sdk/crates/libs/userboundkey-kcm/src/lib.rs	Extension methods for KeyCredentialManager APIs
rust/sdk/crates/libs/userboundkey-kcm/src/bindings.rs	Removed duplicate method definitions, added AlgorithmNotSupported
rust/sdk/crates/libs/sdk-host/src/userboundkey/mod.rs	VTL0 host implementation with Windows Hello credential management
rust/sdk/crates/libs/sdk-host/src/enclave.rs	Enclave lifecycle management APIs (create, load, initialize)
rust/sdk/crates/libs/sdk-enclave/src/userboundkey/mod.rs	VTL1 enclave implementation for user-bound key operations
rust/sdk/crates/libs/sdk-enclave/src/userboundkey/crypto.rs	Cryptographic primitives (AES-GCM, sealing, random generation)
rust/sdk/crates/libs/sdk-enclave/src/userboundkey/types.rs	Error types for user-bound key operations
rust/sdk/crates/libs/sdk-enclave/src/userboundkey/utils.rs	Utility functions for enclave information queries
rust/sdk/crates/libs/windows-enclave/src/manual_bindings/vertdll.rs	Added enclave type and identity constants
rust/sdk/build.ps1	New consolidated SDK build script with EDL generation
rust/sdk/Cargo.toml	Workspace updates for samples and panic=abort profiles
rust/scripts/sign-enclave.ps1	Improved SDK version detection and error handling
rust/scripts/generate_codegen_crates.ps1	Added ImportDirectories parameter support

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Branden Bonaby (bbonaby)]

I assume you exported the SDK's export_enclave_functions macro and then called it in your sample? That's the only thing I can think of.

So something like this

vbsenclave_sdk_enclave::export_enclave_functions!(vbsenclave_sdk_enclave::UserBoundKey::EnclaveImpl);

If you look at:

those $crate mean use the crate that the macro was defined in. But doing the use statement will leave

use abi_types;
use flatbuffer_types;
use Trusted;
//etc for both the consumer's  exports and the sdk  exports

So we end up with the redefinition error, to fix this I can update the generated code to use the fully qualified type/functions names directly instead of doing the use statements. that unfortunately just means the lines might get longer.

Since you have this working already, keep it for now. We can change it later since it's internal. FYI my PR uses the inline way I told you about. I'll have to update it after yours goes in

[Branden Bonaby (bbonaby)]

nah I mean like this

VbsEnclaveTooling/rust/edlcodegen/crates/samples/helloworld/enclave/src/edl_impls.rs

Line 14 in fc5bed1

print(&"Performing secret math operation inside VTL1...".to_string())?;

. No let _ since we can return early with the ?