attestation

Documentation

Index

• func CreateAttestationCertificate(getRemoteReport func([]byte) ([]byte, error), ...) ([]byte, error)
• func CreateAttestationClientTLSConfig(verifyRemoteReport func([]byte) (Report, error), ...) *tls.Config
• func CreateAttestationServerTLSConfig(getRemoteReport func([]byte) ([]byte, error)) (*tls.Config, error)
• func CreateAzureAttestationToken(report, data []byte, baseurl string) (string, error)
• func ParseHTTPS(URL string) (*url.URL, error)
• type Report
  • func ParseClaims(claims uintptr, claimsLength uintptr) (Report, error)
  • func VerifyAzureAttestationToken(rawToken string, baseURL *url.URL) (Report, error)

Functions

func CreateAttestationCertificate

func CreateAttestationCertificate(getRemoteReport func([]byte) ([]byte, error), template, parent *x509.Certificate, pub, priv interface{}) ([]byte, error)

CreateAttestationCertificate creates an X.509 certificate with an embedded report from getRemoteReport.

func CreateAttestationClientTLSConfig

func CreateAttestationClientTLSConfig(verifyRemoteReport func([]byte) (Report, error), verifyReport func(Report) error) *tls.Config

CreateAttestationClientTLSConfig creates a tls.Config object that verifies a certificate with embedded report.

func CreateAttestationServerTLSConfig

func CreateAttestationServerTLSConfig(getRemoteReport func([]byte) ([]byte, error)) (*tls.Config, error)

CreateAttestationServerTLSConfig creates a tls.Config object with a self-signed certificate and an embedded report.

func CreateAzureAttestationToken

func CreateAzureAttestationToken(report, data []byte, baseurl string) (string, error)

CreateAzureAttestationToken creates a Microsoft Azure Attestation Token by sending a report to an Attestation Provider, who is reachable under baseurl. A JSON Web Token in compact serialization is returned.

func ParseHTTPS

func ParseHTTPS(URL string) (*url.URL, error)

ParseHTTPS parses an URL and ensures its scheme is HTTPS.

Types

type Report

type Report struct {
	Data            []byte           // The report data that has been included in the report.
	SecurityVersion uint             // Security version of the enclave. For SGX enclaves, this is the ISVSVN value.
	Debug           bool             // If true, the report is for a debug enclave.
	UniqueID        []byte           // The unique ID for the enclave. For SGX enclaves, this is the MRENCLAVE value.
	SignerID        []byte           // The signer ID for the enclave. For SGX enclaves, this is the MRSIGNER value.
	ProductID       []byte           // The Product ID for the enclave. For SGX enclaves, this is the ISVPRODID value.
	TCBStatus       tcbstatus.Status // The status of the enclave's TCB level.
}

Report is a parsed enclave report.

func ParseClaims

func ParseClaims(claims uintptr, claimsLength uintptr) (Report, error)

func VerifyAzureAttestationToken

func VerifyAzureAttestationToken(rawToken string, baseURL *url.URL) (Report, error)

VerifyAzureAttestationToken takes a Microsoft Azure Attestation Token in JSON Web Token compact serialization format and verifies the tokens public claims and signature. The Attestation providers keys are loaded from baseURL over an TLS connection. The validation is based on the trust in this TLS channel. Note, that the token's issuer (iss) has to equal the baseURL's string representation.

Attention: the calling function needs to ensure the scheme of baseURL is HTTPS, e.g. by calling the ParseHTTPS function of this package.