feat(policy): add stable RTMR1 signer anchor and revocation - #1035
Open
haitaohuang wants to merge 4 commits into
Open
feat(policy): add stable RTMR1 signer anchor and revocation#1035haitaohuang wants to merge 4 commits into
haitaohuang wants to merge 4 commits into
Conversation
Use SHA-384 over the complete unmasked TDINFO as the Policy v2 mapping key. Canonicalize policyData once with only the circular mapping removed so runtime verification and offline tooling extend identical RTMR2 bytes. Verify the signed mapping with the RTMR1-bound policy issuer chain, remove the separate mapping chain and obsolete mapping identity fields, and ignore the legacy outer policy signature as required by the proposal. Resolve the source's initial and current SERVTD_EXT hashes through its authenticated JSON mapping, allowing an older destination to accept a newer source release without predicting its hash. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Carry authenticated SERVTD_EXT continuity evidence through migration and rebinding. Ignore legacy host-supplied Init_TDINFO after validating its framing, reject lookup misses or SVN rollback, and fail closed when SERVTD_ATTR masking makes the endorsed unmasked hashes inapplicable. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Retain authority-maintained hash history when adding a release, allow multiple hashes at one SVN, and reject conflicting duplicate assignments. Emit deterministic mapping bytes and validate signed mappings before use. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Measure the policy signer as a stable root-certificate plus leaf-subject anchor in both runtime and offline hashing. Add optional authenticated servTD CRL delivery, signer-chain enforcement at initialization and peer validation, and a monotonic servtd CRL policy floor.\n\nPort only the proposal-specific implementation from ms/integration while retaining tcbmapping's existing JSON mapping and identity model. Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
haitaohuang
force-pushed
the
rtmr1-signer-anchor-port
branch
from
September 4, 2026 21:41
64a3f90 to
cf2bee7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the RTMR1 signer-anchor proposal in #916 as a continuation of #1032:
migtd-hash;servtdCrlNumpolicy floor so peers cannot regress revocation state.The full policy issuer chain remains enrolled in CFV and recorded in the event payload. This changes only the RTMR1 measurement input and signer-revocation enforcement. The existing JSON TCB mapping and TD Identity model from #1032 are retained.
This PR is stacked on #1032 and is intended as its focused continuation.
Validation
Follow-up work
See the future-work section in #1032 for the broader roadmap. Remaining related items identified while checking the TCB-mapping and signer-anchor work are:
x5chainmaterial, apply the local servTD CRL to it, and consume authenticated peer CoRIM mappings during migration;nbfandexpclaims because MigTD does not have a trusted wall clock;