tpm-enacttrust: surface attester-bound nonce as a claim (#427)#432
tpm-enacttrust: surface attester-bound nonce as a claim (#427)#432flaviens wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR closes the nonce-freshness visibility gap in the tpm-enacttrust attestation scheme by surfacing the attester-bound quote qualifying data (TPMS_ATTEST.ExtraData) as a nonce claim during ExtractClaims. This enables appraisal policies to enforce challenge-response freshness (e.g., compare against the session eat_nonce) without changing the scheme’s default appraisal behavior.
Changes:
- Expose
TPMS_ATTEST.ExtraDataas thenonceclaim inscheme/tpm-enacttrustExtractClaims. - Add a regression test that constructs an EnactTrust token with a chosen
ExtraDatavalue and asserts it is surfaced asclaims["nonce"].
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| scheme/tpm-enacttrust/scheme.go | Adds nonce claim sourced from TPMS_ATTEST.ExtraData to support policy-based freshness checks. |
| scheme/tpm-enacttrust/scheme_test.go | Adds regression test validating that ExtractClaims surfaces ExtraData as the nonce claim. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| claims["firmware-version"] = decoded.AttestationData.FirmwareVersion | ||
| claims["node-id"] = decoded.NodeId.String() | ||
| claims["pcr-digest"] = []byte(decoded.AttestationData.AttestedQuoteInfo.PCRDigest) | ||
| // Surface the attester-bound qualifying data (TPMS_ATTEST.ExtraData) so an |
There was a problem hiding this comment.
This is not how the Challenge is verified.
Please refer to other schemes, where the Challenge (nonce) is verified during ValidateEvidenceIntegrity() check
There was a problem hiding this comment.
yogeshbdeshpande
left a comment
yogeshbdeshpande
left a comment
There was a problem hiding this comment.
Please see the comments!
6ac910b to
86bfd4e
Compare
yogeshbdeshpande
left a comment
yogeshbdeshpande
left a comment
There was a problem hiding this comment.
Thanks for making the changes, LGTM!
|
@flaviens Please check the Integration tests, they also need modification, perhaps! |
The tpm-enacttrust scheme appraised the quote signature and the PCR digest, but never checked the nonce the attester bound into the quote's qualifying data (TPMS_ATTEST.ExtraData). A correctly-signed quote captured once could be replayed to obtain affirming at any later time. ValidateEvidenceIntegrity now compares ExtraData against the session nonce and returns BadEvidence on a mismatch, the same way the other schemes check freshness. Includes tests for the matching and stale cases. The integration tests are updated to match: the gen-token helper gains a -nonce flag that binds the session nonce into ExtraData, the generator passes the nonce through for enacttrust, and a stale-nonce row is added to the freshness-check-fail test.
86bfd4e to
9aee82a
Compare
Fixes the freshness gap reported in #427.
The
tpm-enacttrustscheme appraises the quote signature and the PCR digest against the reference value, but never exposes the nonce the attester bound into the quote's qualifying data (TPMS_ATTEST.ExtraData). A correctly-signed quote captured once can therefore be replayed to obtainaffirmingat any later time.This surfaces
ExtraDataas thenonceclaim inExtractClaims, so an appraisal policy can compare it against the session's expected nonce (theeat_noncethe framework reflects into the EAR) and returncontraindicatedon a stale quote. Enforcement stays in policy rather than the scheme, so the default behaviour is unchanged and operators opt in.Note on encoding: the evidence nonce is standard base64 while the EAT
eat_nonceis URL-safe base64, so a policy should normalise before comparing.Includes a regression test asserting the claim is surfaced.