attestation

Documentation

Index

• Variables
• func CertPubkeyFP(cert *x509.Certificate) (string, error)
• func ConnectionCertFP(c tls.ConnectionState) (string, error)
• func KeyFP(publicKey *ecdsa.PublicKey) string
• type Document
  • func Fetch(host string) (*Document, error)
  • func NewDocument(format PredicateType, body []byte) (*Document, error)
  • func (d *Document) Hash() string
  • func (d *Document) Verify() (*Verification, error)
• type Measurement
  • func (m *Measurement) Equals(other *Measurement) error
  • func (m *Measurement) Fingerprint() string
• type PredicateType
• type Provider
• type Verification
  • func VerifyAttestationJSON(j []byte) (*Verification, error)

Variables

var (
	ErrFormatMismatch      = errors.New("attestation format mismatch")
	ErrMeasurementMismatch = errors.New("measurement mismatch")
)

var (
	NitroEnclaveVerifierOpts = nitrite.VerifyOptions{}
)

Functions

func CertPubkeyFP

func CertPubkeyFP(cert *x509.Certificate) (string, error)

CertPubkeyFP returns the fingerprint of the public key of a given certificate

func ConnectionCertFP

func ConnectionCertFP(c tls.ConnectionState) (string, error)

ConnectionCertFP gets the KeyFP of the public key of a TLS connection state

func KeyFP

func KeyFP(publicKey *ecdsa.PublicKey) string

KeyFP returns the fingerprint of a given ECDSA public key

Types

type Document

type Document struct {
	Format PredicateType `json:"format"`
	Body   string        `json:"body"`
}

Document represents an attestation document

func Fetch

func Fetch(host string) (*Document, error)

Fetch retrieves the attestation document from a given enclave hostname

func NewDocument

func NewDocument(format PredicateType, body []byte) (*Document, error)

NewDocument creates a new attestation document from a given format and body

func (*Document) Hash

func (d *Document) Hash() string

Hash returns the SHA-256 hash of the attestation document

func (*Document) Verify

func (d *Document) Verify() (*Verification, error)

Verify checks the attestation document against its trust root and returns the inner measurements

type Measurement

type Measurement struct {
	Type      PredicateType
	Registers []string
}

func (*Measurement) Equals

func (m *Measurement) Equals(other *Measurement) error

func (*Measurement) Fingerprint

func (m *Measurement) Fingerprint() string

Fingerprint computes the SHA-256 hash of all measurements, or returns the single measurement if there is only one

type PredicateType

type PredicateType string

const (
	AWSNitroEnclaveV1 PredicateType = "https://tinfoil.sh/predicate/aws-nitro-enclave/v1"
	SevGuestV1        PredicateType = "https://tinfoil.sh/predicate/sev-snp-guest/v1"
	SevGuestV2        PredicateType = "https://tinfoil.sh/predicate/sev-snp-guest/v2"
	TdxGuestV1        PredicateType = "https://tinfoil.sh/predicate/tdx-guest/v1"
)

type Provider

type Provider interface {
	RequestAttestation(userData []byte) (*Document, error)
}

Provider represents a universal interface to request attestation documents

type Verification

type Verification struct {
	Measurement *Measurement
	PublicKeyFP string
}

func VerifyAttestationJSON

func VerifyAttestationJSON(j []byte) (*Verification, error)

VerifyAttestationJSON verifies an attestation document in JSON format and returns the inner measurements