feat(policy): bind signer anchors to dedicated EKU - #1038
Open
haitaohuang wants to merge 6 commits into
Open
Conversation
Use SHA-384 over the complete unmasked TDINFO as the Policy v2 mapping key. Canonicalize policyData once with only the circular mapping removed so runtime verification and offline tooling extend identical RTMR2 bytes. Verify the signed mapping with the RTMR1-bound policy issuer chain, remove the separate mapping chain and obsolete mapping identity fields, and ignore the legacy outer policy signature as required by the proposal. Resolve the source's initial and current SERVTD_EXT hashes through its authenticated JSON mapping, allowing an older destination to accept a newer source release without predicting its hash. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Carry authenticated SERVTD_EXT continuity evidence through migration and rebinding. Ignore legacy host-supplied Init_TDINFO after validating its framing, reject lookup misses or SVN rollback, and fail closed when SERVTD_ATTR masking makes the endorsed unmasked hashes inapplicable. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Retain authority-maintained hash history when adding a release, allow multiple hashes at one SVN, and reject conflicting duplicate assignments. Emit deterministic mapping bytes and validate signed mappings before use. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
Measure the policy signer as a stable root-certificate plus leaf-subject anchor in both runtime and offline hashing. Add optional authenticated servTD CRL delivery, signer-chain enforcement at initialization and peer validation, and a monotonic servtd CRL policy floor.\n\nPort only the proposal-specific implementation from ms/integration while retaining tcbmapping's existing JSON mapping and identity model. Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
Add feature-gated signed CoRIM TCB mappings, authenticated peer transport, and direct signer-anchor enrollment. Keep JSON mappings as the default, support optional simplified servTD identity, and fail closed for date or status rules when identity data is unavailable. Co-authored-by: Haitao Huang <haitaohuang@microsoft.com> Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
haitaohuang
force-pushed
the
signer-eku-constraints-port
branch
2 times, most recently
from
September 5, 2026 01:18
fafa6d5 to
5b76bbe
Compare
Derive the RTMR1 signer anchor from the root certificate fingerprint and a dedicated leaf Extended Key Usage OID. Preserve leaf identity continuity during peer validation by requiring exact Subject Distinguished Name and Subject Alternative Name matches in addition to the signer EKU. Match signed CoRIM chains anchor-first across dedicated EKUs, reject missing, ambiguous, or any-purpose EKUs, retain issuer CA constraints, and update certificate generation plus focused identity and rotation fixtures. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com> Assisted-by: GitHub Copilot CLI:GPT-5.6 Sol
haitaohuang
force-pushed
the
signer-eku-constraints-port
branch
from
September 5, 2026 02:23
5b76bbe to
0f9e9af
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is a stacked continuation of #1037, #1035, and #1032. The new commit adds a dedicated leaf Extended Key Usage to the RTMR1 signer fingerprint while retaining certificate identity continuity checks.
anyExtendedKeyUsagevalues;x5chainleaves anchor-first across their dedicated EKUs without hard-coding the signer OID;Validation
cryptoandpolicy;cargo test -p crypto -p policy(68 tests);