veraison / rust-ccatoken

Implementation of the Arm CCA attestation token in Rust

This is not the repo you're looking for

This repository is no longer in use. Various aspects of Veraison have been split into separate repositories.

If you're looking for the main Veraison services repository, you can find it here:

https://github.com/veraison/services

Please look into the the project overview on Veraison Organization for the description of how Veraison code is organized and where to look for specific things:

https://github.com/veraison

This repository is now archived!

rust-ccatoken's Issues

minimal CLI

We should have a binary alongside the library code that exercises all the (sub)modules of this crate.

It can be used as a quick demonstrator of the integrated functionality exposed by the crate, e.g.:

• crypto verification

$ ccatoken verify token.cbor tastore.json

• evidence appraisal

$ ccatoken appraise token.cbor rvstore.json

stores should be traits

The stores (reference values and trust anchors) should be defined as interfaces.
The library should offer a concrete implementation of the traits that is simple and minimalist. The current in-memory stores can be repurposed for that.

test plan

Define the test plan for the crate. The document (e.g., an entry in the wiki of this repo), should contain separate sections:

• CBOR decoding
• Crypto verification
• Appraisal

Each section should describe a number of meaningful tests for functionality and should include a test description, test vector(s) and the expected outcome (i.e., success, or failure w/ reason).

appraisal API

After successful verification, the platform and realm claims-sets are appraised against the configured reference values. The output of the appraisal is an ar4si trustworthiness vector.

CPAK has the wrong encoding

Not sure how, but I managed to confuse CPAK with RAK in the trust anchor store.

CPAK should be provisioned in a JSON-friendly format to fit in the store data model.

JWK is preferred over textual SPKI as it's a native JSON format and doesn't need any escaping on serialisation.

decode the EAT collection

On receipt of the CCA token, the first thing to do is to (CBOR) decode the EAT collection wrapper around the platform and realm tokens.

verification API

Verification of the CCA token is a three-legged procedure comprising cryptographic verification of the platform and realm tokens, as well as their hash-lock binding.

Platform

1. CBOR decode the Sign1 array
2. decode the payload into a Platform claims-set
3. fetch the instance-id to lookup the matching CPAK from the TA store
4. use the CPAK to verify the Platform Sign1

Realm

1. CBOR decode the Sign1 array
2. decode the payload into a Realm claims-set
3. fetch the RAK from the associated claim
4. use the RAK to verify the Realm Sign1

Binding

• fetch the RAK hash algorithm identifier from the Realm claims-set
• use it to hash the RAK
• check that the nonce claim in the Platform claims-set matches the computed hash of the RAK