attestation

Documentation

Overview

This package deals with the low level attestation and verification logic of Constellation nodes.

General tpm attestation code that is not subjective to a single platform should go into the vtpm package. Since attestation capabilities can differ between platforms, the attestation code should go into a subpackage for that respective platform.

We commonly implement the following two interfaces for a platform:

// Issuer issues an attestation document.
type Issuer interface {
    oid.Getter
    Issue(userData []byte, nonce []byte) (quote []byte, err error)
}

// Validator is able to validate an attestation document.
type Validator interface {
    oid.Getter
    Validate(attDoc []byte, nonce []byte) ([]byte, error)
}

Attestation code for new platforms needs to implement these two interfaces.

Index

• Constants
• func CompareExtraData(quoteData, expectedData []byte) bool
• func DeriveClusterID(secret, salt []byte) ([]byte, error)
• func MakeExtraData(userData []byte, nonce []byte) []byte
• type Logger
• type NOPLogger
  • func (NOPLogger) Infof(string, ...interface{})
  • func (NOPLogger) Warnf(string, ...interface{})

Constants

const (

	// MeasurementSecretContext is the value to use for info
	// when deriving the measurement secret from the master secret.
	MeasurementSecretContext = "measurementSecret"
)

Functions

func CompareExtraData

func CompareExtraData(quoteData, expectedData []byte) bool

CompareExtraData compares the extra data of a quote with the expected extra data. Returns true if the data from the quote matches the expected data. If the slices are not of equal length, the shorter slice is padded with zeros.

func DeriveClusterID

func DeriveClusterID(secret, salt []byte) ([]byte, error)

DeriveClusterID derives the cluster ID from a salt and secret value.

func MakeExtraData

func MakeExtraData(userData []byte, nonce []byte) []byte

MakeExtraData binds userData to a random nonce used in attestation.

Types

type Logger

type Logger interface {
	Infof(format string, args ...any)
	Warnf(format string, args ...any)
}

Logger is a logger used to print warnings and infos during attestation validation.

type NOPLogger

type NOPLogger struct{}

NOPLogger is a no-op implementation of Logger.

func (NOPLogger) Infof

func (NOPLogger) Infof(string, ...interface{})

Infof is a no-op.

func (NOPLogger) Warnf

func (NOPLogger) Warnf(string, ...interface{})

Warnf is a no-op.