mirror of
https://github.com/luxfi/mpc.git
synced 2026-10-30 14:45:41 +00:00
zeekay
41c32bd4a8
Adds the canonical TEE attestation verifier package at cc/attest. This
is the home for chain validation + trust anchor management; the
luxcpp/crypto/attestation parser primitives feed bytes here BEFORE
their measurement output is trusted.
Stage 1 — SEV-SNP — PRODUCTION:
- cc/attest/sev.go: SEVSNP{} verifier built on
github.com/google/go-sev-guest v0.14.1. Live VCEK fetch from AMD
KDS, ARK→ASK→VCEK chain validation, signature verify against the
leaf, MEASUREMENT/REPORT_DATA/HOST_DATA/CHIP_ID extraction,
caller-supplied policy gates (WithExpectedReportData,
WithExpectedMeasurement). 197 LOC.
- testdata/: real-vendor Milan attestation report + VCEK leaf
committed verbatim from the upstream go-sev-guest test corpus.
Tests replay the AMD KDS responses via SimpleGetter so CI never
hits the network.
- 9 SEV-SNP tests passing (happy path, dispatch, length reject,
tampered signature, wrong report_data, wrong measurement,
deterministic composite hash, unknown kind, stub-panic guard).
Stage 2 — TDX — STUB (#222 stage 2):
- cc/attest/tdx.go: TDX{}.Verify panics with ErrNotImplemented so
any caller routing TDX evidence during stage 1 fails LOUD. Plan
documented inline: go-tdx-guest + Intel PCS + QE/TDX module
identity pinning.
Stage 3 — NRAS — STUB (#222 stage 3):
- cc/attest/nras.go: NRAS{}.Verify panics with ErrNotImplemented.
Plan: lift the existing pkg/attestation/nvidia NRAS client into
the cc/attest contract with a JWKS cache.
Wire-in:
- pkg/attestation/composite.go gains VerifyEvidence(ctx, opts...)
which dispatches each Evidence blob to cc/attest by Issuer.
Callers (kms release gate, scheduler) MUST invoke this before
accepting parser output.
Doc:
- cc/attest/doc.go states the production/stub matrix and the
layering contract between the C-ABI parser and this package.
49 lines
1.9 KiB
Go
49 lines
1.9 KiB
Go
// Copyright (c) 2026, Lux Industries Inc.
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package attest
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
)
|
|
|
|
// NRAS is the NVIDIA Remote Attestation Service verifier.
|
|
//
|
|
// Status: STUB — tracked at issue #222 stage 3.
|
|
//
|
|
// Production plan (intentionally not yet implemented):
|
|
//
|
|
// - Parse the NRAS-signed JWT (RFC 7519) carrying the GPU device-state
|
|
// report.
|
|
// - Validate the JWS signature against the NRAS signing key fetched
|
|
// from the NRAS JWKS endpoint, with a TTL'd cache and a force-rotate
|
|
// hook for emergency key rotation.
|
|
// - Verify the EAT/JWT claims: nbf, exp, nonce binding, audience.
|
|
// - Cross-check the embedded device-state report against the RIM
|
|
// (Reference Integrity Manifest) for the asserted driver+VBIOS pair
|
|
// (see pkg/attestation/nvidia/rim.go for the existing RIM type).
|
|
// - Extract the per-GPU UUID, driver version, VBIOS version, and the
|
|
// per-GPU measurement digest.
|
|
// - Compose CompositeHash via the same domain-separated SHA-256 as
|
|
// the SEV path.
|
|
//
|
|
// pkg/attestation/nvidia already implements NRAS request/response shaping
|
|
// and JWT signature verification against a caller-supplied trust root.
|
|
// Stage 3 lifts that into the cc/attest contract: a single Verify(ctx,
|
|
// evidence, opts...) entry point with an internal JWKS cache and the
|
|
// canonical VerifiedReport output shape.
|
|
//
|
|
// Verify panics so any caller routing NRAS evidence to it during stage 1
|
|
// fails LOUD. See TDX.Verify for the rationale.
|
|
type NRAS struct{}
|
|
|
|
// Verify implements Verifier. NOT YET IMPLEMENTED — do not enable NRAS
|
|
// dispatch in production until #222 stage 3 lands.
|
|
func (NRAS) Verify(ctx context.Context, evidence []byte, opts ...Option) (*VerifiedReport, error) {
|
|
panic(fmt.Sprintf("%v: NRAS verifier; tracked at #222 stage 3 (use NRAS JWT + JWKS cache)",
|
|
ErrNotImplemented))
|
|
}
|
|
|
|
var _ Verifier = NRAS{}
|