diff --git a/README-CCA.md b/README-CCA.md index 758c002..38c6e54 100644 --- a/README-CCA.md +++ b/README-CCA.md @@ -11,7 +11,7 @@ Attestation Key (RAK) in JSON Web Key (JWK) format[1](#inputs-ex). ```shell evcli cca create \ - --claims=cca-claims.json \ + --claims=cca-claims-rev03-mandatory-only.json \ --iak=ec256.json \ --rak=ec384.json ``` @@ -19,7 +19,7 @@ evcli cca create \ On success, you should see the following printed to stdout: ```console ->> "cca-claims.cbor" successfully created +>> "cca-claims-rev03-mandatory-only.cbor" successfully created ``` The CBOR-encoded CCA token is stored in the current working directory with a @@ -30,9 +30,9 @@ For example: ```shell evcli cca create \ - --claims=cca-claims.json \ + --claims=cca-claims-rev03-mandatory-only.json \ --iak=ec256.json \ - --rak=ec384.json + --rak=ec384.json \ --token=my.cbor ``` @@ -45,12 +45,12 @@ part of IAK) needs to be supplied, as the public part of RAK, present in the token is used for signature verification. To check the CCA attestation token in my.cbor using the public key in -es256-pub.json: +ec256-pub.json: ```shell evcli cca check \ --token=my.cbor \ - --key=es256-pub.json + --key=ec256-pub.json ``` A message will indicate whether the signature has been successfully verified: @@ -63,38 +63,40 @@ In such case, the claim set is printed to stdout in JSON format: ```json { - "cca-platform-token": { - "cca-platform-profile": "tag:arm.com,2023:cca_platform#1.0.0", - "cca-platform-challenge": "Bea1iETGoM0ZOCBpuv2w5JRmKjrc+P3hFHjpM5Ua8XkP9d5ceOPbESPaCiB6i2ZVbgoi8Z7mS9wviZU7azJVXw==", - "cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", - "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", - "cca-platform-config": "AQID", - "cca-platform-lifecycle": 12288, - "cca-platform-sw-components": [ - { - "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", - "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" - } - ], - "cca-platform-service-indicator": "https://veraison.example/v1/challenge-response", - "cca-platform-hash-algo-id": "sha-256" - }, - "cca-realm-delegated-token": { - "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", - "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", - "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", - "cca-realm-extensible-measurements": [ - "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", - "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", - "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", - "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" - ], - "cca-realm-hash-algo-id": "sha-256", - "cca-realm-public-key": "BIL70TKptcOWh5+7FTQNkFCXjlXHnVJ5oroOlYVPN+IM0vZPO3K1cLvXc+7iznaEJe31Re2+if+v4OlrvUbicPIHlsRIuY2vRqdk0nRC5ubthPjOyBfm7ManHTo959Z+zQ==", - "cca-realm-public-key-hash-algo-id": "sha-512" - } + "cca-platform-token": { + "cca-platform-profile": "tag:arm.com,2024:cca_platform#2.0.0", + "cca-platform-challenge": "7XfHA65jZpacZCXm641XwF33IHV1AxCvd/TJ1oeNpbWIt8WpdLN6ubX3v8B8orZQYVmVzjpt3zSUxeIEiNoqQw==", + "cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", + "cca-platform-config": "AQID", + "cca-platform-lifecycle": 12288, + "cca-platform-sw-components": [ + { + "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", + "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" + } + ], + "cca-platform-hash-algo-id": "sha-256", + "cca-platform-client-id": 1 + }, + "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2024:realm#2.0.0", + "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", + "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", + "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "cca-realm-extensible-measurements": [ + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" + ] + , + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "pCACIVgwgvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQlIlgw7fVF7b6J/6/g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E+M7IF+bsxqcdOj3n1n7NAQI=", + "cca-realm-public-key-hash-algo-id": "sha-512", + "cca-realm-mec-policy": "private" + } } - ``` The claim set can also be saved to a file using the `--claims` switch (abbrev. `-c`), as in: @@ -102,7 +104,7 @@ The claim set can also be saved to a file using the `--claims` switch (abbrev. ` ```shell evcli cca check \ --token=my.cbor \ - --key=es256-pub.json \ + --key=ec256-pub.json \ --claims=output-claims.json ``` @@ -126,38 +128,40 @@ The claim set is printed to stdout in JSON format: ```json { - "cca-platform-token": { - "cca-platform-profile": "tag:arm.com,2023:cca_platform#1.0.0", - "cca-platform-challenge": "Bea1iETGoM0ZOCBpuv2w5JRmKjrc+P3hFHjpM5Ua8XkP9d5ceOPbESPaCiB6i2ZVbgoi8Z7mS9wviZU7azJVXw==", - "cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", - "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", - "cca-platform-config": "AQID", - "cca-platform-lifecycle": 12288, - "cca-platform-sw-components": [ - { - "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", - "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" - } - ], - "cca-platform-service-indicator": "https://veraison.example/v1/challenge-response", - "cca-platform-hash-algo-id": "sha-256" - }, - "cca-realm-delegated-token": { - "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", - "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", - "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", - "cca-realm-extensible-measurements": [ - "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", - "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", - "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", - "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" - ], - "cca-realm-hash-algo-id": "sha-256", - "cca-realm-public-key": "BIL70TKptcOWh5+7FTQNkFCXjlXHnVJ5oroOlYVPN+IM0vZPO3K1cLvXc+7iznaEJe31Re2+if+v4OlrvUbicPIHlsRIuY2vRqdk0nRC5ubthPjOyBfm7ManHTo959Z+zQ==", - "cca-realm-public-key-hash-algo-id": "sha-512" - } + "cca-platform-token": { + "cca-platform-profile": "tag:arm.com,2024:cca_platform#2.0.0", + "cca-platform-challenge": "7XfHA65jZpacZCXm641XwF33IHV1AxCvd/TJ1oeNpbWIt8WpdLN6ubX3v8B8orZQYVmVzjpt3zSUxeIEiNoqQw==", + "cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", + "cca-platform-config": "AQID", + "cca-platform-lifecycle": 12288, + "cca-platform-sw-components": [ + { + "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", + "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" + } + ], + "cca-platform-hash-algo-id": "sha-256", + "cca-platform-client-id": 1 + }, + "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2024:realm#2.0.0", + "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", + "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", + "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "cca-realm-extensible-measurements": [ + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" + ] + , + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "pCACIVgwgvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQlIlgw7fVF7b6J/6/g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E+M7IF+bsxqcdOj3n1n7NAQI=", + "cca-realm-public-key-hash-algo-id": "sha-512", + "cca-realm-mec-policy": "private" + } } - ``` ### Verify @@ -181,8 +185,8 @@ claims, platform signing (IAK) and realm signing key (RAK). ```shell evcli cca verify-as attester \ --api-server=https://veraison.example/challenge-response/v1/newSession \ - --claims=cca-claims-without-realm-challenge.json \ - --iak=es256.json \ + --claims=cca-claims-rev00-without-realm-challenge.json \ + --iak=ec256.json \ --rak=ec384.json ``` diff --git a/cmd/cca/create_test.go b/cmd/cca/create_test.go index 4c4ca7b..5481318 100644 --- a/cmd/cca/create_test.go +++ b/cmd/cca/create_test.go @@ -20,23 +20,25 @@ func Test_CreateCmd_default_token_name_ok(t *testing.T) { err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644) require.NoError(t, err) - err = afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) - - cmd := NewCreateCmd(fs) - cmd.SetArgs( - []string{ - "--claims=claims.json", - "--iak=es256.jwk", - "--rak=es384.jwk", - }, - ) - - err = cmd.Execute() - assert.NoError(t, err) - - _, err = fs.Stat("claims.cbor") - assert.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) + + cmd := NewCreateCmd(fs) + cmd.SetArgs( + []string{ + "--claims=claims.json", + "--iak=es256.jwk", + "--rak=es384.jwk", + }, + ) + + err = cmd.Execute() + assert.NoError(t, err, "wrong result for %s", testVec.name) + + _, err = fs.Stat("claims.cbor") + assert.NoError(t, err, "wrong result for %s", testVec.name) + } } func Test_CreateCmd_custom_token_name_ok(t *testing.T) { @@ -48,54 +50,58 @@ func Test_CreateCmd_custom_token_name_ok(t *testing.T) { err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644) require.NoError(t, err) - err = afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) - - cmd := NewCreateCmd(fs) - cmd.SetArgs( - []string{ - "--claims=claims.json", - "--iak=es256.jwk", - "--rak=es384.jwk", - "--token=my.cbor", - }, - ) - - err = cmd.Execute() - assert.NoError(t, err) - - _, err = fs.Stat("my.cbor") - assert.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) + + cmd := NewCreateCmd(fs) + cmd.SetArgs( + []string{ + "--claims=claims.json", + "--iak=es256.jwk", + "--rak=es384.jwk", + "--token=my.cbor", + }, + ) + + err = cmd.Execute() + assert.NoError(t, err, "wrong result for %s", testVec.name) + + _, err = fs.Stat("my.cbor") + assert.NoError(t, err, "wrong result for %s", testVec.name) + } } func Test_CreateCmd_save_token_fail(t *testing.T) { - fs := afero.NewMemMapFs() + for _, testVec := range testValidCCAClaimVecs { + fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644) - require.NoError(t, err) + err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644) + require.NoError(t, err) - err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644) - require.NoError(t, err) + err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644) + require.NoError(t, err) - err = afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - // freeze the FS so that writing is not possible any more - fs = afero.NewReadOnlyFs(fs) + // freeze the FS so that writing is not possible any more + fs = afero.NewReadOnlyFs(fs) - cmd := NewCreateCmd(fs) - cmd.SetArgs( - []string{ - "--claims=claims.json", - "--iak=es256.jwk", - "--rak=es384.jwk", - }, - ) + cmd := NewCreateCmd(fs) + cmd.SetArgs( + []string{ + "--claims=claims.json", + "--iak=es256.jwk", + "--rak=es384.jwk", + }, + ) - expectedErr := `error saving CCA attestation token to file claims.cbor: operation not permitted` + expectedErr := `error saving CCA attestation token to file claims.cbor: operation not permitted` - err = cmd.Execute() - assert.EqualError(t, err, expectedErr) + err = cmd.Execute() + assert.EqualError(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_CreateCmd_RAK_invalid(t *testing.T) { @@ -107,22 +113,24 @@ func Test_CreateCmd_RAK_invalid(t *testing.T) { err = afero.WriteFile(fs, "es384.jwk", testInvalidKey, 0644) require.NoError(t, err) - err = afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - cmd := NewCreateCmd(fs) - cmd.SetArgs( - []string{ - "--claims=claims.json", - "--iak=es256.jwk", - "--rak=es384.jwk", - }, - ) + cmd := NewCreateCmd(fs) + cmd.SetArgs( + []string{ + "--claims=claims.json", + "--iak=es256.jwk", + "--rak=es384.jwk", + }, + ) - expectedErr := `error decoding RAK signing key from es384.jwk: failed to parse key: invalid key type from JSON ()` + expectedErr := `error decoding RAK signing key from es384.jwk: failed to parse key: invalid key type from JSON ()` - err = cmd.Execute() - assert.EqualError(t, err, expectedErr) + err = cmd.Execute() + assert.EqualError(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_CreateCmd_RAK_not_found(t *testing.T) { @@ -131,22 +139,24 @@ func Test_CreateCmd_RAK_not_found(t *testing.T) { err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644) require.NoError(t, err) - err = afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - cmd := NewCreateCmd(fs) - cmd.SetArgs( - []string{ - "--claims=claims.json", - "--iak=es256.jwk", - "--rak=es384.jwk", - }, - ) + cmd := NewCreateCmd(fs) + cmd.SetArgs( + []string{ + "--claims=claims.json", + "--iak=es256.jwk", + "--rak=es384.jwk", + }, + ) - expectedErr := `error loading RAK signing key from es384.jwk: open es384.jwk: file does not exist` + expectedErr := `error loading RAK signing key from es384.jwk: open es384.jwk: file does not exist` - err = cmd.Execute() - assert.EqualError(t, err, expectedErr) + err = cmd.Execute() + assert.EqualError(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_CreateCmd_IAK_invalid(t *testing.T) { @@ -158,22 +168,24 @@ func Test_CreateCmd_IAK_invalid(t *testing.T) { err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644) require.NoError(t, err) - err = afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - cmd := NewCreateCmd(fs) - cmd.SetArgs( - []string{ - "--claims=claims.json", - "--iak=es256.jwk", - "--rak=es384.jwk", - }, - ) + cmd := NewCreateCmd(fs) + cmd.SetArgs( + []string{ + "--claims=claims.json", + "--iak=es256.jwk", + "--rak=es384.jwk", + }, + ) - expectedErr := `error decoding IAK signing key from es256.jwk: failed to parse key: invalid key type from JSON ()` + expectedErr := `error decoding IAK signing key from es256.jwk: failed to parse key: invalid key type from JSON ()` - err = cmd.Execute() - assert.EqualError(t, err, expectedErr) + err = cmd.Execute() + assert.EqualError(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_CreateCmd_IAK_not_found(t *testing.T) { @@ -182,22 +194,24 @@ func Test_CreateCmd_IAK_not_found(t *testing.T) { err := afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644) require.NoError(t, err) - err = afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - cmd := NewCreateCmd(fs) - cmd.SetArgs( - []string{ - "--claims=claims.json", - "--iak=es256.jwk", - "--rak=es384.jwk", - }, - ) + cmd := NewCreateCmd(fs) + cmd.SetArgs( + []string{ + "--claims=claims.json", + "--iak=es256.jwk", + "--rak=es384.jwk", + }, + ) - expectedErr := `error loading IAK signing key from es256.jwk: open es256.jwk: file does not exist` + expectedErr := `error loading IAK signing key from es256.jwk: open es256.jwk: file does not exist` - err = cmd.Execute() - assert.EqualError(t, err, expectedErr) + err = cmd.Execute() + assert.EqualError(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_CreateCmd_claims_not_found(t *testing.T) { diff --git a/cmd/cca/test_common.go b/cmd/cca/test_common.go index 5c1e4d3..2836b77 100644 --- a/cmd/cca/test_common.go +++ b/cmd/cca/test_common.go @@ -67,6 +67,106 @@ var ( "cca-realm-public-key-hash-algo-id": "sha-256" } }`) + testValidCCAClaimsRev03MandatoryOnly = []byte(`{ + "cca-platform-token": { + "cca-platform-profile": "tag:arm.com,2024:cca_platform#2.0.0", + "cca-platform-challenge": "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=", + "cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", + "cca-platform-config": "AQID", + "cca-platform-lifecycle": 12288, + "cca-platform-sw-components": [ + { + "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", + "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" + } + ], + "cca-platform-hash-algo-id": "sha-256", + "cca-platform-client-id": 1 + }, + "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2024:realm#2.0.0", + "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", + "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", + "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "cca-realm-extensible-measurements": [ + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" + ] + , + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "pCACIVgwgvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQlIlgw7fVF7b6J/6/g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E+M7IF+bsxqcdOj3n1n7NAQI=", + "cca-realm-public-key-hash-algo-id": "sha-512", + "cca-realm-mec-policy": "private" + } + }`) + testValidCCAClaimsRev03All = []byte(`{ + "cca-platform-token": { + "cca-platform-profile": "tag:arm.com,2024:cca_platform#2.0.0", + "cca-platform-challenge": "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=", + "cca-platform-implementation-id":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", + "cca-platform-config": "AQID", + "cca-platform-lifecycle": 12288, + "cca-platform-sw-components": [ + { + "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", + "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" + } + ], + "cca-platform-service-indicator" : "https://veraison.example/v1/challenge-response", + "cca-platform-hash-algo-id": "sha-256", + "cca-platform-client-id": 1, + "cca-platform-manufacturing-config": "AQID", + "cca-platform-peer-signers": "BQUFBQU=", + "cca-platform-extension": [ + { + "hash-algo-id": "sha-256", + "device-measurements-digest": "3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu8=", + "certificate-chain-digest": "3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+7w==", + "uses-ide": true, + "protocol": "spdm-1.2.0", + "vca-digest": "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P", + "device-type": "cxl-type-3", + "encryption-type": 0 + }, + { + "device-measurements-digest": "3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu8=", + "certificate-chain-digest": "3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+7w==", + "uses-ide": true, + "protocol": "other-protocol-1.2.3", + "device-type": "other-device-2" + } + ], + "cca-platform-tbb-rotpk": [ + { + "name": "DM", + "active-array-index": 0, + "index": 0, + "hash": "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=" + } + ] + }, + "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2024:realm#2.0.0", + "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", + "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", + "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "cca-realm-extensible-measurements": [ + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" + ] + , + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "pCACIVgwgvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQlIlgw7fVF7b6J/6/g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E+M7IF+bsxqcdOj3n1n7NAQI=", + "cca-realm-public-key-hash-algo-id": "sha-512", + "cca-realm-mec-policy": "private" + } + }`) testValidCCAClaimsNoNonce = []byte(`{ "cca-platform-token": { "cca-platform-profile": "tag:arm.com,2023:cca_platform#1.0.0", @@ -98,6 +198,54 @@ var ( "cca-realm-public-key-hash-algo-id": "sha-256" } }`) + testValidCCAClaimsRev03NoNonce = []byte(`{ + "cca-platform-token": { + "cca-platform-profile": "tag:arm.com,2024:cca_platform#2.0.0", + "cca-platform-challenge": "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=", + "cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", + "cca-platform-config": "AQID", + "cca-platform-lifecycle": 12288, + "cca-platform-sw-components": [ + { + "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", + "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" + } + ], + "cca-platform-hash-algo-id": "sha-256", + "cca-platform-client-id": 1 + }, + "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2024:realm#2.0.0", + "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", + "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "cca-realm-extensible-measurements": [ + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" + ], + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "pCACIVgwgvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQlIlgw7fVF7b6J/6/g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E+M7IF+bsxqcdOj3n1n7NAQI=", + "cca-realm-public-key-hash-algo-id": "sha-256", + "cca-realm-mec-policy": "private" + } + }`) + testValidCCAClaimVecs = []struct { + data []byte + name string + }{ + {testValidCCAClaims, "testValidCCAClaims"}, + {testValidCCAClaimsRev03MandatoryOnly, "testValidCCAClaimsRev03MandatoryOnly"}, + {testValidCCAClaimsRev03All, "testValidCCAClaimsRev03All"}, + } + testValidCCAClaimNoNonceVecs = []struct { + data []byte + name string + }{ + {testValidCCAClaimsNoNonce, "testValidCCAClaimsNoNonce"}, + {testValidCCAClaimsRev03NoNonce, "testValidCCAClaimsRev03NoNonce"}, + } testSessionURI = "http://veraison.example/challenge-response/v1" testNonce = []byte("ABABABABABABABABABABABABABABABABABABABABABABABABABABABABABABABAB") testInvalidCCAToken = common.MustHexDecode(` diff --git a/cmd/cca/verify_as_attester_test.go b/cmd/cca/verify_as_attester_test.go index 2c6cc79..068cc41 100644 --- a/cmd/cca/verify_as_attester_test.go +++ b/cmd/cca/verify_as_attester_test.go @@ -45,51 +45,55 @@ func Test_AttesterCmd_claims_not_found(t *testing.T) { func Test_AttesterCmd_platform_key_not_found(t *testing.T) { fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) + err := afero.WriteFile(fs, "rak.jwk", testValidRAK, 0644) require.NoError(t, err) - err = afero.WriteFile(fs, "rak.jwk", testValidRAK, 0644) - require.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - cmd := NewAttesterCmd(fs, attesterVeraisonClient) - cmd.SetArgs( - []string{ - "--api-server=http://veraison.example/challenge-response/v1", - "--claims=claims.json", - "--iak=iak.jwk", - "--rak=rak.jwk", - }, - ) + cmd := NewAttesterCmd(fs, attesterVeraisonClient) + cmd.SetArgs( + []string{ + "--api-server=http://veraison.example/challenge-response/v1", + "--claims=claims.json", + "--iak=iak.jwk", + "--rak=rak.jwk", + }, + ) - expectedErr := `error loading Platform signing key from iak.jwk: open iak.jwk: file does not exist` + expectedErr := `error loading Platform signing key from iak.jwk: open iak.jwk: file does not exist` - err = cmd.Execute() - assert.EqualError(t, err, expectedErr) + err = cmd.Execute() + assert.EqualError(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_AttesterCmd_realm_key_not_found(t *testing.T) { fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) + err := afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) require.NoError(t, err) - err = afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) - require.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - cmd := NewAttesterCmd(fs, attesterVeraisonClient) - cmd.SetArgs( - []string{ - "--api-server=http://veraison.example/challenge-response/v1", - "--claims=claims.json", - "--iak=iak.jwk", - "--rak=rak.jwk", - }, - ) + cmd := NewAttesterCmd(fs, attesterVeraisonClient) + cmd.SetArgs( + []string{ + "--api-server=http://veraison.example/challenge-response/v1", + "--claims=claims.json", + "--iak=iak.jwk", + "--rak=rak.jwk", + }, + ) - expectedErr := `error loading Realm signing key from rak.jwk: open rak.jwk: file does not exist` + expectedErr := `error loading Realm signing key from rak.jwk: open rak.jwk: file does not exist` - err = cmd.Execute() - assert.EqualError(t, err, expectedErr) + err = cmd.Execute() + assert.EqualError(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_AttesterCmd_claims_invalid(t *testing.T) { @@ -123,85 +127,91 @@ func Test_AttesterCmd_claims_invalid(t *testing.T) { func Test_AttesterCmd_platform_key_invalid(t *testing.T) { fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) - - err = afero.WriteFile(fs, "iak.jwk", testInvalidKey, 0644) + err := afero.WriteFile(fs, "iak.jwk", testInvalidKey, 0644) require.NoError(t, err) err = afero.WriteFile(fs, "rak.jwk", testValidRAK, 0644) require.NoError(t, err) - cmd := NewAttesterCmd(fs, attesterVeraisonClient) - cmd.SetArgs( - []string{ - "--api-server=http://veraison.example/challenge-response/v1", - "--claims=claims.json", - "--iak=iak.jwk", - "--rak=rak.jwk", - }, - ) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - expectedErr := `error decoding Platform signing key from iak.jwk: failed to parse key: invalid key type from JSON ()` + cmd := NewAttesterCmd(fs, attesterVeraisonClient) + cmd.SetArgs( + []string{ + "--api-server=http://veraison.example/challenge-response/v1", + "--claims=claims.json", + "--iak=iak.jwk", + "--rak=rak.jwk", + }, + ) - err = cmd.Execute() - assert.ErrorContains(t, err, expectedErr) + expectedErr := `error decoding Platform signing key from iak.jwk: failed to parse key: invalid key type from JSON ()` + + err = cmd.Execute() + assert.ErrorContains(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_AttesterCmd_realm_key_invalid(t *testing.T) { fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) - - err = afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) + err := afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) require.NoError(t, err) err = afero.WriteFile(fs, "rak.jwk", testInvalidKey, 0644) require.NoError(t, err) - cmd := NewAttesterCmd(fs, attesterVeraisonClient) - cmd.SetArgs( - []string{ - "--api-server=http://veraison.example/challenge-response/v1", - "--claims=claims.json", - "--iak=iak.jwk", - "--rak=rak.jwk", - }, - ) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - expectedErr := `error decoding Realm signing key from rak.jwk: failed to parse key: invalid key type from JSON ()` + cmd := NewAttesterCmd(fs, attesterVeraisonClient) + cmd.SetArgs( + []string{ + "--api-server=http://veraison.example/challenge-response/v1", + "--claims=claims.json", + "--iak=iak.jwk", + "--rak=rak.jwk", + }, + ) - err = cmd.Execute() - assert.ErrorContains(t, err, expectedErr) + expectedErr := `error decoding Realm signing key from rak.jwk: failed to parse key: invalid key type from JSON ()` + + err = cmd.Execute() + assert.ErrorContains(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_AttesterCmd_bad_server_url(t *testing.T) { fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) - - err = afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) + err := afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) require.NoError(t, err) err = afero.WriteFile(fs, "rak.jwk", testValidRAK, 0644) require.NoError(t, err) - cmd := NewAttesterCmd(fs, attesterVeraisonClient) - cmd.SetArgs( - []string{ - "--api-server=http://vera:son", - "--claims=claims.json", - "--iak=iak.jwk", - "--rak=rak.jwk", - }, - ) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) - expectedErr := `malformed session URI: parse "http://vera:son": invalid port ":son" after host` + cmd := NewAttesterCmd(fs, attesterVeraisonClient) + cmd.SetArgs( + []string{ + "--api-server=http://vera:son", + "--claims=claims.json", + "--iak=iak.jwk", + "--rak=rak.jwk", + }, + ) - err = cmd.Execute() - assert.EqualError(t, err, expectedErr) + expectedErr := `malformed session URI: parse "http://vera:son": invalid port ":son" after host` + + err = cmd.Execute() + assert.EqualError(t, err, expectedErr, "wrong result for %s", testVec.name) + } } func Test_AttesterCmd_ok(t *testing.T) { @@ -210,37 +220,39 @@ func Test_AttesterCmd_ok(t *testing.T) { mc := mock_deps.NewMockIVeraisonClient(ctrl) - mc.EXPECT().SetSessionURI(testSessionURI) - mc.EXPECT().SetEvidenceBuilder(gomock.Any()) - mc.EXPECT().SetIsInsecure(false) - mc.EXPECT().SetCerts([]string{}) - mc.EXPECT().SetDeleteSession(true) - mc.EXPECT().SetNonceSz(uint(64)) - mc.EXPECT().Run().Return([]byte("ok"), nil) - fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) - - err = afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) + err := afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) require.NoError(t, err) err = afero.WriteFile(fs, "rak.jwk", testValidRAK, 0644) require.NoError(t, err) - cmd := NewAttesterCmd(fs, mc) - cmd.SetArgs( - []string{ - "--api-server=" + testSessionURI, - "--claims=claims.json", - "--iak=iak.jwk", - "--rak=rak.jwk", - }, - ) - - err = cmd.Execute() - assert.NoError(t, err) + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) + + mc.EXPECT().SetSessionURI(testSessionURI) + mc.EXPECT().SetEvidenceBuilder(gomock.Any()) + mc.EXPECT().SetIsInsecure(false) + mc.EXPECT().SetCerts([]string{}) + mc.EXPECT().SetDeleteSession(true) + mc.EXPECT().SetNonceSz(uint(64)) + mc.EXPECT().Run().Return([]byte("ok"), nil) + + cmd := NewAttesterCmd(fs, mc) + cmd.SetArgs( + []string{ + "--api-server=" + testSessionURI, + "--claims=claims.json", + "--iak=iak.jwk", + "--rak=rak.jwk", + }, + ) + + err = cmd.Execute() + assert.NoError(t, err, "wrong result for %s", testVec.name) + } } func Test_AttesterCmd_protocol_run_failed(t *testing.T) { @@ -249,102 +261,109 @@ func Test_AttesterCmd_protocol_run_failed(t *testing.T) { mc := mock_deps.NewMockIVeraisonClient(ctrl) - mc.EXPECT().SetSessionURI(testSessionURI) - mc.EXPECT().SetEvidenceBuilder(gomock.Any()) - mc.EXPECT().SetIsInsecure(false) - mc.EXPECT().SetCerts([]string{}) - mc.EXPECT().SetDeleteSession(true) - mc.EXPECT().SetNonceSz(uint(64)) - mc.EXPECT().Run().Return(nil, errors.New("failed")) - fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644) - require.NoError(t, err) - - err = afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) + err := afero.WriteFile(fs, "iak.jwk", testValidIAK, 0644) require.NoError(t, err) err = afero.WriteFile(fs, "rak.jwk", testValidRAK, 0644) require.NoError(t, err) - cmd := NewAttesterCmd(fs, mc) - cmd.SetArgs( - []string{ - "--api-server=" + testSessionURI, - "--claims=claims.json", - "--iak=iak.jwk", - "--rak=rak.jwk", - }, - ) - - err = cmd.Execute() - assert.EqualError(t, err, "error in attesterVeraisonClient Run failed") + for _, testVec := range testValidCCAClaimVecs { + err = afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err) + + mc.EXPECT().SetSessionURI(testSessionURI) + mc.EXPECT().SetEvidenceBuilder(gomock.Any()) + mc.EXPECT().SetIsInsecure(false) + mc.EXPECT().SetCerts([]string{}) + mc.EXPECT().SetDeleteSession(true) + mc.EXPECT().SetNonceSz(uint(64)) + mc.EXPECT().Run().Return(nil, errors.New("failed")) + + cmd := NewAttesterCmd(fs, mc) + cmd.SetArgs( + []string{ + "--api-server=" + testSessionURI, + "--claims=claims.json", + "--iak=iak.jwk", + "--rak=rak.jwk", + }, + ) + + err = cmd.Execute() + assert.EqualError(t, err, "error in attesterVeraisonClient Run failed", "wrong result for %s", testVec.name) + } } func Test_attesterEvidenceBuilder_BuildCCAEvidence_ok(t *testing.T) { - fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaimsNoNonce, 0644) - require.NoError(t, err) - - pClaims, rClaims, err := loadUnValidatedCCAClaimsFromFile(fs, "claims.json") - assert.NoError(t, err) pSigner, err := common.SignerFromJWK(testValidIAK) assert.NoError(t, err) rSigner, err := common.SignerFromJWK(testValidRAK) assert.NoError(t, err) - mut := attesterEvidenceBuilder{ - Pclaims: pClaims, Rclaims: rClaims, - Psigner: pSigner, Rsigner: rSigner, - } + for _, testVec := range testValidCCAClaimNoNonceVecs { + fs := afero.NewMemMapFs() + err := afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err, "failed to write claims.json for %s", testVec.name) - supportedMediaTypes := []string{ - "a", CCATokenMediaType, "b", "c", - } + pClaims, rClaims, err := loadUnValidatedCCAClaimsFromFile(fs, "claims.json") + assert.NoError(t, err, "failed to load claims.json for %s", testVec.name) - expectedMediaType := CCATokenMediaType - actualEvidence, actualMediaType, err := mut.BuildEvidence(testNonce, supportedMediaTypes) - fmt.Printf("e: %x\n", actualEvidence) - assert.NoError(t, err) - assert.Equal(t, expectedMediaType, actualMediaType) -} + mut := attesterEvidenceBuilder{ + Pclaims: pClaims, Rclaims: rClaims, + Psigner: pSigner, Rsigner: rSigner, + } -func Test_attesterEvidenceBuilder_BuildEvidence_unsupported_media_type(t *testing.T) { - fs := afero.NewMemMapFs() - err := afero.WriteFile(fs, "claims.json", testValidCCAClaimsNoNonce, 0644) - require.NoError(t, err) + supportedMediaTypes := []string{ + "a", CCATokenMediaType, "b", "c", + } - pClaims, rClaims, err := loadUnValidatedCCAClaimsFromFile(fs, "claims.json") - assert.NoError(t, err) + expectedMediaType := CCATokenMediaType + actualEvidence, actualMediaType, err := mut.BuildEvidence(testNonce, supportedMediaTypes) + fmt.Printf("e: %x\n", actualEvidence) + assert.NoError(t, err, "failed to build evidence for %s", testVec.name) + assert.Equal(t, expectedMediaType, actualMediaType, "wrong media type for %s", testVec.name) + } +} +func Test_attesterEvidenceBuilder_BuildEvidence_unsupported_media_type(t *testing.T) { pSigner, err := common.SignerFromJWK(testValidIAK) assert.NoError(t, err) rSigner, err := common.SignerFromJWK(testValidRAK) assert.NoError(t, err) - mut := attesterEvidenceBuilder{ - Pclaims: pClaims, Rclaims: rClaims, - Psigner: pSigner, Rsigner: rSigner, - } + for _, testVec := range testValidCCAClaimNoNonceVecs { + fs := afero.NewMemMapFs() + err := afero.WriteFile(fs, "claims.json", testVec.data, 0644) + require.NoError(t, err, "failed to write claims.json for %s", testVec.name) - supportedMediaTypes := []string{ - "a", "b", "c", - } + pClaims, rClaims, err := loadUnValidatedCCAClaimsFromFile(fs, "claims.json") + assert.NoError(t, err, "failed to load claims.json for %s", testVec.name) - expectedEvidence := []byte(nil) - expectedMediaType := "" + mut := attesterEvidenceBuilder{ + Pclaims: pClaims, Rclaims: rClaims, + Psigner: pSigner, Rsigner: rSigner, + } - actualEvidence, actualMediaType, err := mut.BuildEvidence(testNonce, supportedMediaTypes) + supportedMediaTypes := []string{ + "a", "b", "c", + } - expectedErr := fmt.Sprintf( - "expecting media type %s, got %s", - CCATokenMediaType, strings.Join(supportedMediaTypes, ", "), - ) + expectedEvidence := []byte(nil) + expectedMediaType := "" - assert.EqualError(t, err, expectedErr) - assert.Equal(t, expectedEvidence, actualEvidence) - assert.Equal(t, expectedMediaType, actualMediaType) + actualEvidence, actualMediaType, err := mut.BuildEvidence(testNonce, supportedMediaTypes) + + expectedErr := fmt.Sprintf( + "expecting media type %s, got %s", + CCATokenMediaType, strings.Join(supportedMediaTypes, ", "), + ) + + assert.EqualError(t, err, expectedErr, "wrong error for %s", testVec.name) + assert.Equal(t, expectedEvidence, actualEvidence, "wrong evidence for %s", testVec.name) + assert.Equal(t, expectedMediaType, actualMediaType, "wrong media type for %s", testVec.name) + } } diff --git a/go.mod b/go.mod index 67fc692..f0dd3cb 100644 --- a/go.mod +++ b/go.mod @@ -11,9 +11,9 @@ require ( github.com/spf13/viper v1.11.0 github.com/stretchr/testify v1.11.1 github.com/veraison/apiclient v0.4.1-0.20260826100211-017a8838452e - github.com/veraison/ccatoken v1.3.2-0.20250512122414-b26aba0635c4 + github.com/veraison/ccatoken v1.4.1-0.20260825135807-84623d402f35 github.com/veraison/go-cose v1.3.0 - github.com/veraison/psatoken v1.2.1-0.20240719122628-26fe500fd5d4 + github.com/veraison/psatoken v1.2.1-0.20240723091511-b9c092a19d7b ) require ( diff --git a/go.sum b/go.sum index c45610e..54b920d 100644 --- a/go.sum +++ b/go.sum @@ -210,16 +210,16 @@ github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw= github.com/veraison/apiclient v0.4.1-0.20260826100211-017a8838452e h1:sBZgs0BQDPBzKZOYAw9HsJdkH9SF28x1lY3wu1a2qwM= github.com/veraison/apiclient v0.4.1-0.20260826100211-017a8838452e/go.mod h1:XfEC4u05zv3u9c/vPy2RsVGckzoWhxFj97htzRR3ltA= -github.com/veraison/ccatoken v1.3.2-0.20250512122414-b26aba0635c4 h1:t2GQueIc1SrErZpprs2ll9ETaXln/nOCPVRq7OejzfQ= -github.com/veraison/ccatoken v1.3.2-0.20250512122414-b26aba0635c4/go.mod h1:vMqdbW4H/8A3oT+24qssuIK3Aefy06XqzTELGg+gWAg= +github.com/veraison/ccatoken v1.4.1-0.20260825135807-84623d402f35 h1:ubBcxAEWczWK8As123en44DVtNl0BkeOHlCZU4IbUGE= +github.com/veraison/ccatoken v1.4.1-0.20260825135807-84623d402f35/go.mod h1:YheIuCJOdorTOO2Zrx8msKRGmDj/xP5YSMt/yJHcvPk= github.com/veraison/cmw v0.2.0 h1:BWEvwZnD4nn5osq6XwQpTRcGxwV+Su4t6ytdAbVXAJY= github.com/veraison/cmw v0.2.0/go.mod h1:OiYKk1t6/Fmmg30ZpSMzi4nKr5kt3374sNTkgxC5BDs= github.com/veraison/eat v0.0.0-20251105185612-2c0e43e22ea9 h1:noS47o2qRghkF4gpxAhzjJEEzQBvSnaJnHHlnMxdDpU= github.com/veraison/eat v0.0.0-20251105185612-2c0e43e22ea9/go.mod h1:LJytELnmBplHNkk1fLRMczbXGSste3ORVdBqgZWgeN8= github.com/veraison/go-cose v1.3.0 h1:2/H5w8kdSpQJyVtIhx8gmwPJ2uSz1PkyWFx0idbd7rk= github.com/veraison/go-cose v1.3.0/go.mod h1:df09OV91aHoQWLmy1KsDdYiagtXgyAwAl8vFeFn1gMc= -github.com/veraison/psatoken v1.2.1-0.20240719122628-26fe500fd5d4 h1:N7qg7vDF2mUg7I+8AoU+ieJ20cgcShwFHXHkV5b2YAA= -github.com/veraison/psatoken v1.2.1-0.20240719122628-26fe500fd5d4/go.mod h1:6+WZzXr0ACXYiUAJJqTaCxW43gY2+gEaCoVNdDv3+Bw= +github.com/veraison/psatoken v1.2.1-0.20240723091511-b9c092a19d7b h1:6YJOkhWhor5I3LBllc71T2Pvch488thIdR8MxxvyDb0= +github.com/veraison/psatoken v1.2.1-0.20240723091511-b9c092a19d7b/go.mod h1:6+WZzXr0ACXYiUAJJqTaCxW43gY2+gEaCoVNdDv3+Bw= github.com/veraison/swid v1.1.1-0.20251003121634-fd1f7f1e1897 h1:ze1ulqK70S7PRignyZzFDBJHNVEDyISk5FDv9Uh3UFw= github.com/veraison/swid v1.1.1-0.20251003121634-fd1f7f1e1897/go.mod h1:d5jt76uMNbTfQ+f2qU4Lt8RvWOTsv6PFgstIM1QdMH0= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= diff --git a/misc/cca-claims-bad-norealm.json b/misc/cca-claims-rev00-bad-norealm.json similarity index 100% rename from misc/cca-claims-bad-norealm.json rename to misc/cca-claims-rev00-bad-norealm.json diff --git a/misc/cca-claims-without-realm-challenge.json b/misc/cca-claims-rev00-without-realm-challenge.json similarity index 97% rename from misc/cca-claims-without-realm-challenge.json rename to misc/cca-claims-rev00-without-realm-challenge.json index 998fb18..fbe69c6 100644 --- a/misc/cca-claims-without-realm-challenge.json +++ b/misc/cca-claims-rev00-without-realm-challenge.json @@ -37,6 +37,7 @@ "cca-platform-hash-algo-id": "sha-256" }, "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2023:realm#1.0.0", "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", "cca-realm-extensible-measurements": [ diff --git a/misc/cca-claims.json b/misc/cca-claims-rev00.json similarity index 97% rename from misc/cca-claims.json rename to misc/cca-claims-rev00.json index a7e2840..92aa321 100644 --- a/misc/cca-claims.json +++ b/misc/cca-claims-rev00.json @@ -16,6 +16,7 @@ "cca-platform-hash-algo-id": "sha-256" }, "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2023:realm#1.0.0", "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", diff --git a/misc/cca-claims-rev03-all.json b/misc/cca-claims-rev03-all.json new file mode 100644 index 0000000..9abebe2 --- /dev/null +++ b/misc/cca-claims-rev03-all.json @@ -0,0 +1,65 @@ +{ + "cca-platform-token": { + "cca-platform-profile": "tag:arm.com,2024:cca_platform#2.0.0", + "cca-platform-challenge": "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=", + "cca-platform-implementation-id":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", + "cca-platform-config": "AQID", + "cca-platform-lifecycle": 12288, + "cca-platform-sw-components": [ + { + "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", + "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" + } + ], + "cca-platform-service-indicator" : "https://veraison.example/v1/challenge-response", + "cca-platform-hash-algo-id": "sha-256", + "cca-platform-client-id": 1, + "cca-platform-manufacturing-config": "AQID", + "cca-platform-peer-signers": "BQUFBQU=", + "cca-platform-extension": [ + { + "hash-algo-id": "sha-256", + "device-measurements-digest": "3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu8=", + "certificate-chain-digest": "3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+7w==", + "uses-ide": true, + "protocol": "spdm-1.2.0", + "vca-digest": "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P", + "device-type": "cxl-type-3", + "encryption-type": 0 + }, + { + "device-measurements-digest": "3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu8=", + "certificate-chain-digest": "3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+796tvu/erb7v3q2+7w==", + "uses-ide": true, + "protocol": "other-protocol-1.2.3", + "device-type": "other-device-2" + } + ], + "cca-platform-tbb-rotpk": [ + { + "name": "DM", + "active-array-index": 0, + "index": 0, + "hash": "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=" + } + ] + }, + "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2024:realm#2.0.0", + "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", + "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", + "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "cca-realm-extensible-measurements": [ + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" + ] + , + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "pCACIVgwgvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQlIlgw7fVF7b6J/6/g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E+M7IF+bsxqcdOj3n1n7NAQI=", + "cca-realm-public-key-hash-algo-id": "sha-512", + "cca-realm-mec-policy": "private" + } +} \ No newline at end of file diff --git a/misc/cca-claims-rev03-mandatory-only.json b/misc/cca-claims-rev03-mandatory-only.json new file mode 100644 index 0000000..617964c --- /dev/null +++ b/misc/cca-claims-rev03-mandatory-only.json @@ -0,0 +1,35 @@ +{ + "cca-platform-token": { + "cca-platform-profile": "tag:arm.com,2024:cca_platform#2.0.0", + "cca-platform-challenge": "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=", + "cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", + "cca-platform-config": "AQID", + "cca-platform-lifecycle": 12288, + "cca-platform-sw-components": [ + { + "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", + "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" + } + ], + "cca-platform-hash-algo-id": "sha-256", + "cca-platform-client-id": 1 + }, + "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2024:realm#2.0.0", + "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", + "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", + "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "cca-realm-extensible-measurements": [ + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" + ] + , + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "pCACIVgwgvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQlIlgw7fVF7b6J/6/g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E+M7IF+bsxqcdOj3n1n7NAQI=", + "cca-realm-public-key-hash-algo-id": "sha-512", + "cca-realm-mec-policy": "private" + } +} \ No newline at end of file diff --git a/misc/cca-claims-rev03-without-realm-challenge.json b/misc/cca-claims-rev03-without-realm-challenge.json new file mode 100644 index 0000000..468e092 --- /dev/null +++ b/misc/cca-claims-rev03-without-realm-challenge.json @@ -0,0 +1,33 @@ +{ + "cca-platform-token": { + "cca-platform-profile": "tag:arm.com,2024:cca_platform#2.0.0", + "cca-platform-challenge": "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=", + "cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", + "cca-platform-config": "AQID", + "cca-platform-lifecycle": 12288, + "cca-platform-sw-components": [ + { + "measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=", + "signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ=" + } + ], + "cca-platform-hash-algo-id": "sha-256", + "cca-platform-client-id": 1 + }, + "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2024:realm#2.0.0", + "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", + "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "cca-realm-extensible-measurements": [ + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", + "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==" + ], + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "pCACIVgwgvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQlIlgw7fVF7b6J/6/g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E+M7IF+bsxqcdOj3n1n7NAQI=", + "cca-realm-public-key-hash-algo-id": "sha-256", + "cca-realm-mec-policy": "private" + } +} \ No newline at end of file