lux/cc

mirror of https://github.com/luxfi/cc.git synced 2026-09-24 00:24:54 +00:00

T

zeekay 8aee4295a2 feat(attest): KindSGX — Intel SGX DCAP ECDSA quote verification

Add KindSGX as a new orthogonal hardware Kind, mirroring the SEV-SNP /
NVTrust shape exactly: a zero-value SGX{} Verifier, canonical
VerifiedReport projection, domain-separated CompositeHash, and the
errors.Is refusal taxonomy (nil report on any error).

Pure-Go DCAP verify (no maintained Google go-sgx-guest exists; go-sev-guest
is AMD, go-tdx-guest is TDX and parses neither the SGX v3 quote nor the
enclave report). From crypto/{ecdsa,ecdh,x509,sha256} + encoding/{asn1,
binary,pem} only — zero new dependencies, no cgo, no network on the verify
path. Offline chain of trust, all from the quote bytes + the pinned Intel
SGX Root CA:

  1. structure: version 3, ECDSA-P256 att key, Intel QE vendor ID, every
     length bounded (ErrInvalidEvidence)
  2. PCK chain leaf -> Intel SGX CA -> pinned Intel SGX Root CA, within
     validity at the verification clock (ErrChainInvalid; the root is
     pinned in source, never read from the quote)
  3. QE report ECDSA-signed by the PCK leaf (ErrSignatureInvalid)
  4. attestation-key binding: SHA-256(att_pubkey||qe_auth) == QE
     report_data[0:32], [32:64]==0 (ErrChainInvalid) — the DCAP hinge
  5. ISV enclave report (with header) ECDSA-signed by the bound att key,
     point validated on P-256 first / invalid-curve defense
     (ErrSignatureInvalid)
  6. MRENCLAVE || MRSIGNER -> Measurement (+ individually in Extra);
     pin via WithExpectedMeasurement
  7. freshness: ISV report_data nonce via WithExpectedReportData (ErrPolicy)

Honest scope: TCB-level status + revocation need Intel PCS collateral
(signed TCB Info + QE Identity + CRLs, keyed by FMSPC). Not faked — FMSPC,
CPUSVN, PCESVN, ISV SVN are extracted and surfaced in Extra for a
TCB-evaluating layer; certificate-validity staleness IS enforced here.

Self-registers via init() into a package registry (RegisteredVerifier
lookup) — the open driver-pattern extension point. The legacy Dispatch
switch in verifier.go is unchanged (not edited); folding its default case
into RegisteredVerifier unifies the two routing paths (follow-up).

Tests build a byte-exact, self-consistent SGX ECDSA v3 quote over a fresh
PCK chain (with a real Intel-SGX FMSPC extension) — same pattern as
nvtrust_test.go. Covers happy path, deterministic CompositeHash across
keys, FMSPC + SubjectKeyId fallback, self-registration, pinned-root refusal
of the test chain, and tamper rejection: ISV sig, QE sig, measurement body,
broken att-key binding, wrong measurement/report-data policy, stale chain,
untrusted root, malformed framing.

2026-06-27 13:44:09 -07:00

attest

feat(attest): KindSGX — Intel SGX DCAP ECDSA quote verification

2026-06-27 13:44:09 -07:00

.gitignore

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

go.mod

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

go.sum

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

README.md

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

README.md

luxfi/cc — Confidential Compute attestation

github.com/luxfi/cc is the single, vendor-neutral attestation verifier for the Lux confidential-compute control plane. It is an orthogonal leaf: the MPC custody system (luxfi/mpc), the TEE custody extension (luxfi/tee), and the confidential-AI / proof-of-AI system (luxfi/ai) all depend on it, and it depends on none of them. There is exactly one attestation verifier; hardware platforms are orthogonal Kinds behind one Verify interface.

Packages

Import	Purpose
`github.com/luxfi/cc/attest`	The `Verifier` interface, `VerifiedReport`, `Option`, and `Dispatch(kind, evidence, opts...)`. One entry point per hardware `Kind`.
`github.com/luxfi/cc/attest/nvidia`	NVIDIA GPU primitives: GPU evidence parser, signed-RIM verifier + measurement matcher, and the NRAS remote-attestation JWS client. Backend for `KindNVTrust`.

Kinds (orthogonal hardware platforms)

KindSEVSNP — AMD SEV-SNP CPU. PRODUCTION. Live VCEK fetch from the AMD KDS, full ARK→ASK→VCEK chain + report-signature verification (google/go-sev-guest).
KindTDX — Intel TDX CPU. Stub (ErrNotImplemented, fail-loud). Tracked for go-tdx-guest + Intel PCS.
KindNVTrust — NVIDIA GPU confidential compute. PRODUCTION local-RIM mode (cloud-free): verifies the NVIDIA-signed Reference Integrity Manifest against an operator-pinned key, then matches every reported GPU measurement to the signed golden value. No NVIDIA cloud dependency. The remote NVIDIA Remote Attestation Service (NRAS) JWS path is the lower-level nvidia.NRASClient primitive for deployments that accept a cloud anchor.

Invariants

No insecure mode. A verify with no trust anchor is refused, never best-effort. KindNVTrust refuses an empty RIM or empty trust-root set.
One VerifiedReport type shared across all consumers — required so the kms.CompositeAttestation release-gate interface has a single, unambiguous signature across luxfi/mpc, luxfi/tee, and luxfi/ai.
(nil, err) means refuse. No partial reports on error.
Tests never hit the network. AMD KDS responses are replayed from attest/testdata; NVIDIA RIM fixtures are signed in-test.

Build

export SDKROOT="$(xcrun --show-sdk-path)"   # macOS
GOWORK=off go build ./...
GOWORK=off go test ./...