ias

package
v0.2201.6 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 6, 2022 License: Apache-2.0 Imports: 12 Imported by: 6

Documentation

Overview

Package ias provides routines for interacting with the Intel Attestation Service.

Index

Constants

View Source
const NonceMaxLen = 32

NonceMaxLen is the maximum length of the AVR nonce.

View Source
const SPIDSize = 16

SPIDSize is the size of SPID.

View Source
const TimestampFormat = "2006-01-02T15:04:05.999999999"

TimestampFormat is the format of the AVR timestamp, suitable for use with time.Parse.

Workaround for https://github.com/golang/go/issues/21990

Variables

View Source
var (
	// ErrMalformedSPID is the error returned when an SPID is malformed.
	ErrMalformedSPID = errors.New("ias: malformed SPID")
)
View Source
var IntelTrustRoots = x509.NewCertPool()

IntelTrustRoots are Intel's IAS signing root certificates.

Functions

func BuildMrSignerBlacklist

func BuildMrSignerBlacklist(allowTestKeys bool)

BuildMrSignerBlacklist builds the MRSIGNER blacklist.

func CertFromPEM

func CertFromPEM(raw []byte) (*x509.Certificate, []byte, error)

func NewMockAVR

func NewMockAVR(quote []byte, nonce string) ([]byte, error)

NewMockAVR returns a mock AVR for the given quote and nonce, after doing some light sanity checking on the quote.

This is only useful for runtimes with with AVR verification disabled at compile time (ie: built with `OASIS_UNSAFE_SKIP_AVR_VERIFY=1`).

func SetAllowDebugEnclaves

func SetAllowDebugEnclaves()

SetAllowDebugEnclave will enable running and communicating with enclaves with debug flag enabled in AVR for the remainder of the process' lifetime.

func SetSkipVerify

func SetSkipVerify()

SetSkipVerify will disable AVR signature verification for the remainder of the process' lifetime.

func UnsetAllowDebugEnclaves

func UnsetAllowDebugEnclaves()

UnsetAllowDebugEnclave will disable running and communicating with enclaves with debug flag enabled in AVR for the remainder of the process' lifetime.

Types

type AVRBundle

type AVRBundle struct {
	Body             []byte `json:"body"`
	CertificateChain []byte `json:"certificate_chain"`
	Signature        []byte `json:"signature"`
}

AVRBundle is a serialized Attestation Verification Report bundled with additional data required to allow offline verification.

func (*AVRBundle) Open

func (b *AVRBundle) Open(trustRoots *x509.CertPool, ts time.Time) (*AttestationVerificationReport, error)

Open decodes and validates the AVR contained in the bundle, and returns the Attestation Verification Report iff it is valid

type AttestationVerificationReport

type AttestationVerificationReport struct {
	ID                    string                `json:"id"`
	Timestamp             string                `json:"timestamp"`
	Version               int                   `json:"version"`
	ISVEnclaveQuoteStatus ISVEnclaveQuoteStatus `json:"isvEnclaveQuoteStatus"`
	ISVEnclaveQuoteBody   []byte                `json:"isvEnclaveQuoteBody"`
	RevocationReason      *CRLReason            `json:"revocationReason"`
	PSEManifestStatus     *PSEManifestStatus    `json:"pseManifestStatus"`
	PSEManifestHash       string                `json:"pseManifestHash"`
	PlatformInfoBlob      string                `json:"platformInfoBlob"`
	Nonce                 string                `json:"nonce"`
	EPIDPseudonym         []byte                `json:"epidPseudonym"`
	AdvisoryURL           string                `json:"advisoryURL"`
	AdvisoryIDs           []string              `json:"advisoryIDs"`
}

AttestationVerificationReport is a deserialized Attestation Verification Report (AVR).

func DecodeAVR

func DecodeAVR(data, encodedSignature, encodedCertChain []byte, trustRoots *x509.CertPool, ts time.Time) (*AttestationVerificationReport, error)

DecodeAVR decodes and validates an Attestation Verification Report.

func UnsafeDecodeAVR added in v0.2201.0

func UnsafeDecodeAVR(data []byte) (*AttestationVerificationReport, error)

UnsafeDecodeAVR decodes and validates an Attestation Verification Report, but does not validate the signature.

WARNING: This MUST only be used for diagnostic purposes.

func (*AttestationVerificationReport) Quote

func (a *AttestationVerificationReport) Quote() (*Quote, error)

Quote decodes and returns the enclave quote component of an Attestation Verification Report.

type Body

type Body struct {
	Version                                uint16
	SignatureType                          SignatureType
	GID                                    uint32
	ISVSVNQuotingEnclave                   uint16
	ISVSVNProvisioningCertificationEnclave uint16
	Basename                               [32]byte
}

Body is an enclave quote body.

func (*Body) MarshalBinary

func (b *Body) MarshalBinary() ([]byte, error)

MarshalBinary encodes Body to byte array.

func (*Body) UnmarshalBinary

func (b *Body) UnmarshalBinary(data []byte) error

UnmarshalBinary decodes Body from byte array.

type CRLReason

type CRLReason int

CRLReason is a certificate revocation reason code as specified in RFC 5280 5.3.1.

const (
	ReasonUnspecified          CRLReason = 0
	ReasonKeyCompromise        CRLReason = 1
	ReasonCACompromise         CRLReason = 2
	ReasonAffiliationChanged   CRLReason = 3
	ReasonSuperseded           CRLReason = 4
	ReasonCessationOfOperation CRLReason = 5
	ReasonCertificateHold      CRLReason = 6
	ReasonRemoveFromCRL        CRLReason = 8
	ReasonPrivilegeWithdrawn   CRLReason = 9
	ReasonAACompromise         CRLReason = 10
)

Predefined CRL revocation reason codes.

func (CRLReason) String

func (r CRLReason) String() string

type ISVEnclaveQuoteStatus

type ISVEnclaveQuoteStatus int

ISVEnclaveQuoteStatus is the status of an enclave quote.

const (
	QuoteOK ISVEnclaveQuoteStatus
	QuoteSignatureInvalid
	QuoteGroupRevoked
	QuoteSignatureRevoked
	QuoteKeyRevoked
	QuoteSigRLVersionMismatch
	QuoteGroupOutOfDate
	QuoteConfigurationNeeded
	QuoteSwHardeningNeeded
	QuoteConfigurationAndSwHardeningNeeded
)

Predefined ISV enclave quote status codes.

func (*ISVEnclaveQuoteStatus) MarshalText

func (s *ISVEnclaveQuoteStatus) MarshalText() ([]byte, error)

MarshalText implements the encoding.TextMarshaler interface.

func (ISVEnclaveQuoteStatus) String

func (s ISVEnclaveQuoteStatus) String() string

func (*ISVEnclaveQuoteStatus) UnmarshalText

func (s *ISVEnclaveQuoteStatus) UnmarshalText(text []byte) error

UnmarshalText implements the encoding.TextUnmarshaler interface.

type PSEManifestStatus

type PSEManifestStatus int

PSEManifestStatus is the status of a SGX Platform Service Security Property Descriptor.

const (
	ManifestOK PSEManifestStatus = iota
	ManifestUnknown
	ManifestInvalid
	ManifestOutOfDate
	ManifestRevoked
	ManifestRLVersionMismatch
)

Predefined SGX Platform Service Security Property Descriptor status codes.

func (*PSEManifestStatus) MarshalText

func (p *PSEManifestStatus) MarshalText() ([]byte, error)

MarshalText implements the encoding.TextMarshaler interface.

func (PSEManifestStatus) String

func (p PSEManifestStatus) String() string

func (*PSEManifestStatus) UnmarshalText

func (p *PSEManifestStatus) UnmarshalText(text []byte) error

UnmarshalText implements the encoding.TextUnmarshaler interface.

type Quote

type Quote struct {
	Body   Body
	Report Report
}

Quote is an enclave quote.

func (*Quote) MarshalBinary

func (q *Quote) MarshalBinary() ([]byte, error)

MarshalBinary encodes an enclave quote.

func (*Quote) UnmarshalBinary

func (q *Quote) UnmarshalBinary(data []byte) error

UnmarshalBinary decodes an enclave quote.

func (*Quote) Verify

func (q *Quote) Verify() error

Verify checks the quote for validity.

type Report

type Report struct {
	CPUSVN     [16]byte
	MiscSelect uint32
	Attributes sgx.Attributes
	MRENCLAVE  sgx.MrEnclave
	MRSIGNER   sgx.MrSigner
	ISVProdID  uint16
	ISVSVN     uint16
	ReportData [64]byte
}

Report is an enclave report body.

func (*Report) MarshalBinary

func (r *Report) MarshalBinary() ([]byte, error)

MarshalBinary encodes Report into byte array.

func (*Report) UnmarshalBinary

func (r *Report) UnmarshalBinary(data []byte) error

UnmarshalBinary decodes Report from a byte array.

type SPID

type SPID [SPIDSize]byte

SPID is an SPID.

func (SPID) MarshalBinary

func (s SPID) MarshalBinary() (data []byte, err error)

MarshalBinary encodes an SPID into binary form.

func (SPID) String

func (s SPID) String() string

String returns a string representation of the SPID.

func (*SPID) UnmarshalBinary

func (s *SPID) UnmarshalBinary(data []byte) error

UnmarshalBinary decodes a binary marshaled SPID.

type SignatureType

type SignatureType int

SignatureType is the type of signature accommpanying an enclave quote.

const (
	SignatureUnlinkable SignatureType = 0
	SignatureLinkable   SignatureType = 1
)

Predefined enclave quote signature types.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL