attestation

Documentation

Index

• Variables
• func CertFP(c tls.ConnectionState) []byte
• type Document
  • func Fetch(host string) (*Document, error)
  • func (d *Document) Verify() (*Verification, error)
• type Measurement
  • func (m *Measurement) Equals(other *Measurement) error
  • func (m *Measurement) Fingerprint() string
• type PredicateType
• type Provider
• type Verification
  • func VerifyAttestationJSON(j []byte) (*Verification, error)

Variables

var (
	ErrFormatMismatch      = errors.New("attestation format mismatch")
	ErrMeasurementMismatch = errors.New("measurement mismatch")
)

var (
	NitroEnclaveVerifierOpts = nitrite.VerifyOptions{}
)

Functions

func CertFP

func CertFP(c tls.ConnectionState) []byte

CertFP gets the SHA256 fingerprint of a certificate

Types

type Document

type Document struct {
	Format PredicateType `json:"format"`
	Body   string        `json:"body"`
}

Document represents an attestation document

func Fetch

func Fetch(host string) (*Document, error)

Fetch retrieves the attestation document from a given enclave hostname

func (*Document) Verify

func (d *Document) Verify() (*Verification, error)

Verify checks the attestation document against its trust root and returns the inner measurements

type Measurement

type Measurement struct {
	Type      PredicateType
	Registers []string
}

func (*Measurement) Equals

func (m *Measurement) Equals(other *Measurement) error

func (*Measurement) Fingerprint

func (m *Measurement) Fingerprint() string

Fingerprint computes the SHA-256 hash of all measurements, or returns the single measurement if there is only one

type PredicateType

type PredicateType string

const (
	AWSNitroEnclaveV1 PredicateType = "https://tinfoil.sh/predicate/aws-nitro-enclave/v1"
	SevGuestV1        PredicateType = "https://tinfoil.sh/predicate/snp-sev-guest/v1"
)

type Provider

type Provider interface {
	RequestAttestation(userData []byte) (*Document, error)
}

Provider represents a universal interface to request attestation documents

type Verification

type Verification struct {
	Measurement *Measurement
	CertFP      []byte
}

func VerifyAttestationJSON

func VerifyAttestationJSON(j []byte) (*Verification, error)

VerifyAttestationJSON verifies an attestation document in JSON format and returns the inner measurements