refactor(attestation): verify policy against TDINFO_STRUCT#780
Open
MichalTarnacki wants to merge 1 commit intointel:mainfrom
Open
refactor(attestation): verify policy against TDINFO_STRUCT#780MichalTarnacki wants to merge 1 commit intointel:mainfrom
MichalTarnacki wants to merge 1 commit intointel:mainfrom
Conversation
MichalTarnacki
force-pushed
the
TDINFO_STRUCT
branch
2 times, most recently
from
cf8a159 to
bb3ca0b
Compare
Adapt rebinding handshake to use init_tdinfo instead of init_policy: - rebinding.rs: rename params in pre_session_data_exchange functions - server_client.rs: rename init_td_report -> init_tdinfo in RATLS cert creation/verification, update pre_session_data parsing with init_tdinfo naming, compare mrowner at TDINFO offset 112..160 directly instead of digest_sha384(init_policy) - spdm_rsp.rs: rename pre_session_data parsing, compare mrowner directly Per GHCI 1.5, policy and SERVTD_EXT verification operates on TDINFO_STRUCT: - verify_servtd_hash(): accepts TDINFO bytes, returns TdInfo (not TdxReport), parses via MaybeUninit + copy_nonoverlapping - verify_init_tdreport() -> verify_init_tdinfo(): renamed, returns TdInfo - Add get_rtmrs_from_tdinfo() and setup_evaluation_data_with_tdinfo() - authenticate_rebinding_old(): 6 params instead of 7 (removed init_policy and init_td_report, replaced with init_tdinfo); calls verify_event_log() directly against RTMRs from init_tdinfo; uses local policy for TCB eval - Remove get_init_tcb_evaluation_info() and TD_INFO_OFFSET constant - Update call sites in server_client.rs and spdm_rsp.rs Co-authored-by: Grams, Stanislaw <stanislaw.grams@intel.com>
MichalTarnacki
force-pushed
the
TDINFO_STRUCT
branch
from
bb3ca0b to
a379436
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per GHCI 1.5, policy and SERVTD_EXT verification operates on TDINFO_STRUCT:
parses via MaybeUninit + copy_nonoverlapping
and init_td_report, replaced with init_tdinfo); calls verify_event_log()
directly against RTMRs from init_tdinfo; uses local policy for TCB eval