Add attestation workflow - #249
Conversation
Demonstrate calling the TpmAttestzService.Attest gRPC service on a switch device.
Add sample logic to verify device attestation.
| return errors.New("OIAK certificate does not contain an RSA public key") | ||
| } | ||
|
|
||
| // 2. Extract public key to verify raw Signature (not a TPMT_SIGNATURE) against the Quote. |
There was a problem hiding this comment.
I think the quote signature will usually be a TPMT_SIGNATURE. Can you default to unmarshalling as a tpm2.TPMTSignature, and fall back to using the raw bytes when that fails?
| return fmt.Errorf("quote signature verification failed: %v", err) | ||
| } | ||
|
|
||
| // 3. Verify unencoded, raw binary data for the TPM2 PCR Quote (TPMS_ATTEST). |
There was a problem hiding this comment.
The default is TPM2B_ATTEST, but you can check for both here.
betuls
left a comment
betuls
left a comment
There was a problem hiding this comment.
Please move these files to a specific folder, such as "reference_verifier", because the logic doesn't support all the verification paths yet and we should avoid confusing the repo readers.
|
|
||
| log.Infof("AttestResponse:\n%s", prototext.Format(resp)) | ||
|
|
||
| if err := VerifyRemoteAttestation(resp, expectedPCRs, pcrIndices, nonce, trustedRoots, nil, hashAlgo); err != nil { |
There was a problem hiding this comment.
hashAlgo is the TPM PCR hash agorithm, but here you use it as the quote signature hash algorithm.
| return fmt.Errorf("unsupported hash algorithm %v: must be SHA256 or SHA384", hashAlgo) | ||
| } | ||
| // 1. Parse and cryptographically verify the OIAK against the Root/Intermediate CA chain. | ||
| block, _ := pem.Decode([]byte(resp.GetAttestationCert().GetOiakCert())) |
There was a problem hiding this comment.
You might need to loop over this to account for multi-block pem certs
| ## Building and Running with Bazel | ||
|
|
||
| ```bash | ||
| bazel run //service/attest:attest -- \ |
There was a problem hiding this comment.
This needs updating with the new path
| | -------------------- | ------ | ------------------------- | --------------------------------------------------------------------------------- | | ||
| | `-addr` | string | `localhost:50051` | Address (`host:port`) of the `TpmAttestzService` gRPC server. | | ||
| | `-control_card_role` | string | `CONTROL_CARD_ROLE_ACTIVE` | Control card role to attest (`"CONTROL_CARD_ROLE_ACTIVE"`, `"CONTROL_CARD_ROLE_STANDBY"`, etc.). | | ||
| | `-insecure` | bool | `false` | Use insecure transport credentials (disable TLS). Set to `false` for TLS. | |
There was a problem hiding this comment.
You should clean up the documentation to reflect the current options.
3 participants
Demonstrate calling the TpmAttestzService.Attest gRPC service on a switch device.