mirror of
https://github.com/luxfi/cc.git
synced 2026-09-24 00:24:54 +00:00
zeekay
da19c97e0e
TDX was a fail-loud stub (Verify returned ErrNotImplemented, parsing nothing).
It now performs the complete Intel TDX DCAP attestation flow via the canonical
Google verifier github.com/google/go-tdx-guest (v0.3.1, sibling of the
go-sev-guest used by KindSEVSNP), matching the SEV path's rigor:
- Parse the DCAP v4 quote (QuoteV4 only) via go-tdx-guest/abi.
- Verify the PCK certificate chain embedded in the quote's signed
certification data up to the Intel SGX Root CA pinned inside go-tdx-guest
(verify/trusted_root.pem) — the trust anchor is never taken from the quote.
- Verify the Quoting Enclave (QE) report signature and the attestation-key
binding (QE report data == SHA-256(att key || QE auth data)).
- Verify the TD report (TDQuoteBody) ECDSA-P256 signature.
- Fetch Intel PCS collateral (TCB Info + QE Identity + PCK/Root CRLs) and
enforce TCB status (UpToDate) and revocation. GetCollateral and
CheckRevocations are ON; DefaultOptions leaves them off, so we set them.
- Fold MRTD + the four RTMRs into a 48-byte SHA-384 TD measurement root
(Measurement); raw registers + MRSEAM/TD_ATTRIBUTES/XFAM/etc. in Extra.
- Enforce caller policy (expected measurement / report-data nonce binding)
in constant time, and bind CompositeHash to the canonical TD fields.
(nil, err) always means refuse — no partial report, no best-effort fallback.
go-tdx-guest error strings are classified onto the package refusal taxonomy
(ErrInvalidEvidence / ErrSignatureInvalid / ErrChainInvalid / ErrPolicy).
Tests (attest/tdx_test.go) run offline against a REAL Intel Sapphire Rapids
TDX quote + Intel collateral committed verbatim to testdata/ (from the
go-tdx-guest corpus; the go-tdx-guest `testing` getter is linux-gated, so a
small replay getter is used here):
- real SPR quote passes the full DCAP cryptographic chain;
- full production path refuses the fixture on TCB status (upstream
deliberately bumped the sample TCB SVN above the quote) -> ErrPolicy;
- tamper rejection: flipped MRTD breaks the TD report signature, flipped
ECDSA sig rejected, bad version / truncation / garbage -> ErrInvalidEvidence;
- measurement fold + composite hash determinism + policy binding;
- no-fallback when Intel PCS is unreachable; stale-clock refusal; Dispatch
routing; context cancellation.
verifier_test.go: retired TestStubsReturnNotImplemented /
TestDispatch_StubKindsReturnNotImplemented (TDX was the last stub kind they
asserted) now that TDX is real — mirrors the earlier NVTrust promotion which
already edited this file. go.mod/go.sum: add go-tdx-guest v0.3.1 (latest, < v1).
GOWORK=off go build/vet/test/-race ./... all green.