mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-09-23 09:46:05 +00:00
4adc19b7f5
* Add join-config entry for "enforceIdKeyDigest" bool * Add join-config entry for "idkeydigest" * Initially filled with TPM value from bootstrapper * Add config entries for idkeydigest and enforceIdKeyDigest * Extend azure attestation validator to check idkeydigest, if configured. * Update unittests * Add logger to NewValidator for all CSPs * Add csp to Updateable type Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> Co-authored-by: Daniel Weiße <dw@edgeless.systems>
39 lines
938 B
Go
39 lines
938 B
Go
package qemu
|
|
|
|
import (
|
|
"crypto"
|
|
|
|
"github.com/edgelesssys/constellation/internal/attestation/vtpm"
|
|
"github.com/edgelesssys/constellation/internal/oid"
|
|
"github.com/google/go-tpm/tpm2"
|
|
)
|
|
|
|
// Validator for QEMU VM attestation.
|
|
type Validator struct {
|
|
oid.QEMU
|
|
*vtpm.Validator
|
|
}
|
|
|
|
// NewValidator initializes a new qemu validator with the provided PCR values.
|
|
func NewValidator(pcrs map[uint32][]byte, enforcedPCRs []uint32, log vtpm.WarnLogger) *Validator {
|
|
return &Validator{
|
|
Validator: vtpm.NewValidator(
|
|
pcrs,
|
|
enforcedPCRs,
|
|
unconditionalTrust,
|
|
func(attestation vtpm.AttestationDocument) error { return nil },
|
|
vtpm.VerifyPKCS1v15,
|
|
log,
|
|
),
|
|
}
|
|
}
|
|
|
|
// unconditionalTrust returns the given public key as the trusted attestation key.
|
|
func unconditionalTrust(akPub, instanceInfo []byte) (crypto.PublicKey, error) {
|
|
pubArea, err := tpm2.DecodePublic(akPub)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return pubArea.Key()
|
|
}
|