tvc-axum: signed responses with attestation/manifest headers - #199
Draft
emostov wants to merge 18 commits into
Draft
tvc-axum: signed responses with attestation/manifest headers#199emostov wants to merge 18 commits into
emostov wants to merge 18 commits into
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…pers qos_core 0.12.2 on crates.io does not yet contain the fake manifest builder and trust chain verifier (qos PR #765). Patch all qos_* crates to the same git revision since qos_core uses in-repo path dependencies. TODO: remove once qos PR #765 merges and a new qos_core version is published, then bump the qos_* version pins.
The fake manifest builder and trust chain verifier now live in qos_core::protocol::services::boot (fake behind the "mock" feature), ported from tvc-utils in qos PR #765. Switch the tests to those paths and drop the tvc-utils dev-dependency.
The fake manifest builder and trust chain verifier were ported verbatim
to qos_core::protocol::services::boot::{fake, verify} in qos PR #765
(tkhq/qos#765). tvc-axum tests already consume
them from qos_core, so the crate has no remaining users.
emostov
changed the title
The qos branch removed the boot::fake module and changed verify_attestation_and_manifest to take a validation time and a ManifestCommitmentKind. Replace the fake helpers with test-local envelope construction (threshold-1 manifest-set approval) and seed the mock NSM with the setup manifest commitment PCR so emitted attestation documents pass full verification.
verify_quorum_signature checks the quorum response signature with a known quorum public key. verify_response_trust_chain verifies the attestation and manifest headers with qos_core's verify_attestation_and_manifest, then checks the ephemeral response signature with the attested key and returns it. Both rebuild the RFC 9421 signature base from a SignedResponseParts, recomputing the RFC 9530 content digest from the body so a tampered body fails verification.
Exercise verify_quorum_signature and verify_response_trust_chain end-to-end against responses emitted by ResponseSigningLayer: happy path for both (quorum key taken from the verified manifest), wrong quorum key, tampered body and status, expectation mismatch propagating the qos VerifyError, and missing quorum entry. Drops the hand-rolled signature-base tests these supersede.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
tvc-axumcrate: a towerResponseSigningLayerthat signs every response with the enclave ephemeral key (and optionally the quorum key) using RFC 9421/9530 headers, and attachesx-tvc-attestation-doc(user_data = manifest hash, public_key = ephemeral key) andx-tvc-manifest-envelopeheaders so clients can verify the full trust chain. Includes aQosJson<T>response type for canonicalqos_jsonbodies.Ships the client-side verifiers:
verify_quorum_signature(quorum response signature against a known quorum key) andverify_response_trust_chain(qos_core attestation/manifest verification, then the ephemeral response signature with the attested key).The trust-chain verifier lives in qos_core (tkhq/qos#765);
[patch.crates-io]points qos_* at that branch until it publishes.Verification:
cargo fmt -- --check,cargo clippy --all-targets --all-features -- -D warnings,cargo test -p tvc-axum,cargo build --workspace.