feat(policy): add CoRIM mappings and optional servTD identity - #1037
Open
haitaohuang wants to merge 5 commits into
Open
feat(policy): add CoRIM mappings and optional servTD identity#1037haitaohuang wants to merge 5 commits into
haitaohuang wants to merge 5 commits into
Conversation
Use SHA-384 over the complete unmasked TDINFO as the Policy v2 mapping key. Canonicalize policyData once with only the circular mapping removed so runtime verification and offline tooling extend identical RTMR2 bytes. Verify the signed mapping with the RTMR1-bound policy issuer chain, remove the separate mapping chain and obsolete mapping identity fields, and ignore the legacy outer policy signature as required by the proposal. Resolve the source's initial and current SERVTD_EXT hashes through its authenticated JSON mapping, allowing an older destination to accept a newer source release without predicting its hash. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Carry authenticated SERVTD_EXT continuity evidence through migration and rebinding. Ignore legacy host-supplied Init_TDINFO after validating its framing, reject lookup misses or SVN rollback, and fail closed when SERVTD_ATTR masking makes the endorsed unmasked hashes inapplicable. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Retain authority-maintained hash history when adding a release, allow multiple hashes at one SVN, and reject conflicting duplicate assignments. Emit deterministic mapping bytes and validate signed mappings before use. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Measure the policy signer as a stable root-certificate plus leaf-subject anchor in both runtime and offline hashing. Add optional authenticated servTD CRL delivery, signer-chain enforcement at initialization and peer validation, and a monotonic servtd CRL policy floor.\n\nPort only the proposal-specific implementation from ms/integration while retaining tcbmapping's existing JSON mapping and identity model. Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
Add feature-gated signed CoRIM TCB mappings, authenticated peer transport, and direct signer-anchor enrollment. Keep JSON mappings as the default, support optional simplified servTD identity, and fail closed for date or status rules when identity data is unavailable. Co-authored-by: Haitao Huang <haitaohuang@microsoft.com> Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
haitaohuang
force-pushed
the
corim-optional-servtd-port
branch
from
September 4, 2026 21:41
0b153d3 to
d86b127
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is a stacked continuation of #1035 and #1032. The new commit in this PR implements the CoRIM TCB-mapping and optional servTD Identity proposals tracked in #929 and #930.
COSE_Sign1ES384/ESP384 signatures and RFC 9360x5chain, reject unsupported time claims, and bind the signer to the RTMR1 root-certificate plus leaf-subject anchor from feat(policy): add stable RTMR1 signer anchor and revocation #1035;No documentation, test-fixture, workflow, or integration-script changes are included.
Validation
servtd_corimenabled;Follow-up
The remaining future work is the release-tooling and coverage work described in #1032: independent policy/mapping/identity signer-rotation coverage and stronger two-phase measurement-generation/hash-stability checks.