Skip to content

Commit d813467

Browse files
fdamatofdamato
authored
Include OCP EAT Profile Diagnostic Example, and few minor editorial f… (#76)
* Include OCP EAT Profile Diagnostic Example, and few minor editorial fixes Signed-off-by: Fabrizio Damato <fabrizio.damato@amd.com> * EAT: Address few issues with the OCP Profile Example and add SUEID as optional claim Signed-off-by: Fabrizio Damato <fabrizio.damato@amd.com> * Update specifications/ietf-eat-profile/spec.ocp * Update specifications/ietf-eat-profile/spec.ocp Signed-off-by: Fabrizio Damato <fabrizio.damato@amd.com> --------- Signed-off-by: Fabrizio Damato <fabrizio.damato@amd.com>
1 parent a2ecd1a commit d813467

File tree

4 files changed

+209
-10
lines changed

4 files changed

+209
-10
lines changed

‎specifications/ietf-eat-profile/bibliography.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,4 +68,11 @@ references:
6868
issued:
6969
year: 2024
7070
month: 8
71-
url: "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf"
71+
url: "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf"
72+
- id: "ietf-rfc9052"
73+
title: "CBOR Object Signing and Encryption (COSE): Structures and Process"
74+
publisher: "IETF"
75+
issued:
76+
year: 2022
77+
month: 8
78+
url: "https://datatracker.ietf.org/doc/html/rfc9052"

‎specifications/ietf-eat-profile/cddl/ietf_eat_ocp_profile.cddl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ cwt-eat = {
3030
; UEID claim (Optional)
3131
? &(ueid : 256) => bstr .size (7..33)
3232

33+
; SUEID claim (Optional)
34+
? &(sueid : 257) => bstr .size (7..33)
35+
3336
; OEM ID claim (Optional) // oemid-type is defined in https://datatracker.ietf.org/doc/rfc9711/
3437
? &(oemid : 258) => oemid-type
3538

‎specifications/ietf-eat-profile/diag/ocp-profile-eat-example.diag‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
/ Self-described CBOR tag /
2+
55799(
3+
/ CWT tag 61 /
4+
61(
5+
/ COSE_Sign1 tag 18 /
6+
18([
7+
/ Protected header /
8+
<< {
9+
/ alg: ECDSA P-384 /
10+
1: -51,
11+
/ content-type: application/eat+cwt
12+
3: 263
13+
} >>,
14+
15+
/ Unprotected header /
16+
{
17+
/ x5chain: single certificate /
18+
33: << h'308202a4...certificate_bytes...' >>
19+
},
20+
21+
/ Payload: CWT claims /
22+
<< {
23+
/ Mandatory claims in deterministic order /
24+
25+
/ 1 (0x01): issuer /
26+
1: "Attester-AK-2024",
27+
28+
/ 7 (0x07): cti /
29+
7: h'0123456789abcdef0123456789abcdef',
30+
31+
/ 10 (0x0a): nonce /
32+
10: h'fedcba9876543210fedcba9876543210',
33+
34+
/ 263 (0x190107): dbgstat - disabled /
35+
263: 2,
36+
37+
/ 265 (0x190109): EAT Profile - OCP Security Attestation EAT Profile /
38+
265: 111(h'2b0601040182e42b0103'),
39+
40+
/ 273 (0x190111): measurements /
41+
273: [
42+
[
43+
/ CoAP content-format for concise-evidence /
44+
10571,
45+
46+
/ Concise evidence as CBOR bytestring /
47+
<<({
48+
/ ce.ev-triples /
49+
0: {
50+
/ ce.evidence-triples /
51+
0: [
52+
/ Triple 1: Firmware Component /
53+
[
54+
/ environment-map /
55+
{
56+
/ class /
57+
0: {
58+
/ class-id: tagged-bytes #6.560 with 4-byte identifier /
59+
0: 560(h'01020304'),
60+
/ vendor /
61+
1: "ACME Inc.",
62+
/ model /
63+
2: "ACME RoadRunner Trap"
64+
}
65+
},
66+
/ measurement-map array /
67+
[
68+
{
69+
/ mkey /
70+
0: {
71+
/ index /
72+
0: 1
73+
},
74+
/ mval /
75+
1: {
76+
/ version /
77+
0: {
78+
0: "1.2.3.45"
79+
},
80+
/ svn /
81+
1: 45,
82+
/ digests /
83+
2: [
84+
[
85+
/ sha-384 /
86+
"sha-384",
87+
h'38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b'
88+
]
89+
],
90+
/ integrity-registers: journey digest /
91+
5: [
92+
[
93+
"sha-384",
94+
h'c7ade88fc7a21498a6a5e5c385e1f68bed822b72aa63c4a9a48a3c9c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c8c'
95+
]
96+
]
97+
}
98+
}
99+
]
100+
],
101+
102+
/ Triple 2: Hardware Configuration /
103+
[
104+
/ environment-map /
105+
{
106+
/ class /
107+
0: {
108+
/ class-id: tagged-bytes #6.560 with 4-byte identifier /
109+
0: 560(h'05060708'),
110+
/ vendor /
111+
1: "ACME Inc.",
112+
/ model /
113+
2: "ACME RoadRunner Trap"
114+
}
115+
},
116+
/ measurement-map array /
117+
[
118+
{
119+
/ mkey /
120+
0: {
121+
/ index /
122+
0: 2
123+
},
124+
/ mval /
125+
1: {
126+
/ digests: hash of HW configuration /
127+
2: [
128+
[
129+
/ sha-384 /
130+
"sha-384",
131+
h'1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef'
132+
]
133+
],
134+
/ raw-value: fuse settings /
135+
4: h'00000001',
136+
/ raw-value-mask /
137+
6: h'ffffffff'
138+
}
139+
}
140+
]
141+
],
142+
143+
/ Triple 3: Software Configuration /
144+
[
145+
/ environment-map /
146+
{
147+
/ class /
148+
0: {
149+
/ class-id: tagged-bytes #6.560 with 4-byte identifier /
150+
0: 560(h'090a0b0c'),
151+
/ vendor /
152+
1: "ACME Inc.",
153+
/ model /
154+
2: "ACME RoadRunner Trap"
155+
}
156+
},
157+
/ measurement-map array /
158+
[
159+
{
160+
/ mkey /
161+
0: {
162+
/ index /
163+
0: 3
164+
},
165+
/ mval /
166+
1: {
167+
/ raw-value: security configuration /
168+
4: h'00000003',
169+
/ raw-value-mask /
170+
6: h'000000ff'
171+
}
172+
}
173+
]
174+
]
175+
]
176+
}
177+
}) >>
178+
]
179+
]
180+
} >>,
181+
182+
/ Signature: ES384 signature bytes (96 bytes) /
183+
h'3045022100ab3c8d9e7f1234567890abcdef1234567890abcdef1234567890abcdef123456022100fedcba0987654321fedcba0987654321fedcba0987654321fedcba0987654321'
184+
])
185+
)
186+
)

‎specifications/ietf-eat-profile/spec.ocp‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -191,25 +191,28 @@ serve informational purposes:
191191
7. **ueid** (claim key: 256, encoded as 0x190100)
192192
* This claim is used by the attester to identify the attester. If present, refer to [@{ietf-rfc9711}] for acceptable values for this claim
193193

194-
8. **oemid** (claim key: 258, encoded as 0x190102)
194+
8. **sueid** (claim key: 257, encoded as 0x190101)
195+
* This claim is used by the attester to identify the attester at the different lifecycle stages. If present, refer to [@{ietf-rfc9711}] for acceptable values for this claim
196+
197+
9. **oemid** (claim key: 258, encoded as 0x190102)
195198
* This claim is used by the attester to identify the Original Equipment Manufacturer (OEM) of the hardware. If present, refer to [@{ietf-rfc9711}] for acceptable values for this claim
196199

197-
9. **hwmodel** (claim key: 259, encoded as 0x190103)
200+
10. **hwmodel** (claim key: 259, encoded as 0x190103)
198201
* This claim is used by the attester to differentiate hardware models, products, and variants manufactured by a particular OEM. If present, refer to [@{ietf-rfc9711}] for acceptable values for this claim
199202

200-
10. **uptime** (claim key: 261, encoded as 0x190105)
203+
11. **uptime** (claim key: 261, encoded as 0x190105)
201204
* This claim is used by the attester to indicate the number of seconds elapsed since boot. If present, refer to [@{ietf-rfc9711}] for acceptable values for this claim
202205

203-
11. **bootcount** (claim key: 267, encoded as 0x19010b)
206+
12. **bootcount** (claim key: 267, encoded as 0x19010b)
204207
* This claim is used by the attester to indicate the number of times the attester has booted. If present, refer to [@{ietf-rfc9711}] for acceptable values for this claim
205208

206-
12. **bootseed** (claim key: 268, encoded as 0x19010c)
209+
13. **bootseed** (claim key: 268, encoded as 0x19010c)
207210
* This claim is used by the attester to differentiate boot sessions. If present, refer to [@{ietf-rfc9711}] for acceptable values for this claim
208211

209-
13. **dloas** (claim key: 269, encoded as 0x19010d)
212+
14. **dloas** (claim key: 269, encoded as 0x19010d)
210213
* This claim is used by the attester to point the verifier to the endorsement repository (one example, OCP SAFE). If present, refer to [@{ietf-rfc9711}] for the claim structure.
211214

212-
14. **rim-locators** (claim key: -70001, encoded as 0x3a00011170)
215+
15. **rim-locators** (claim key: -70001, encoded as 0x3a00011170)
213216
* This claim is used by the attester to point the verifier to the rim repository. If present, **SHALL** be an array of corim-locator-map (refer to [@{ietf-rats-corim}]).
214217

215218

@@ -407,5 +410,5 @@ The following example illustrates a CWT containing claims for three target envir
407410
* **Software (SW) Configuration**: RAW Value (e.g., Debug State)
408411

409412
```include {.small}
410-
TODO: fill in with a diag
411-
```
413+
!include diag/ocp-profile-eat-example.diag
414+
```

0 commit comments

Comments
 (0)