@learncard/sss-key-manager 0.2.0 → 0.2.2

package/src/__fixtures__/nitro-attestation/manifest.json

@@ -0,0 +1,60 @@
+{
+    "cases": {
+        "bad-signature": {
+            "accept": false,
+            "reason": "signature"
+        },
+        "debug-zero-pcrs": {
+            "accept": false,
+            "reason": "debug PCRs"
+        },
+        "legacy-user-data": {
+            "accept": true,
+            "previousKeyIds": []
+        },
+        "nonce-mismatch": {
+            "accept": false,
+            "nonceHex": "0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+            "reason": "nonce"
+        },
+        "stale-timestamp": {
+            "accept": false,
+            "reason": "freshness"
+        },
+        "tampered-previous-key-ids": {
+            "accept": false,
+            "reason": "signature"
+        },
+        "truncated-chain": {
+            "accept": false,
+            "reason": "missing intermediate"
+        },
+        "valid": {
+            "accept": true
+        },
+        "wrong-pcr0": {
+            "accept": false,
+            "reason": "pcr"
+        },
+        "wrong-root": {
+            "accept": false,
+            "reason": "root pin"
+        }
+    },
+    "description": "Public fake CA, never trust in production. Freeze verifier clock to nowMs. Certificates valid 2020-2050. userDataBase64 was generated once by crypto::generate_escrow_key_pair; regeneration reuses it. keyId/previousKeyIds (P9.1) are fixture-only labels bound into the canonical-CBOR user_data wrapper, distinct from userDataBase64 (the escrow SPKI itself, still extracted identically from either user_data format).",
+    "keyId": "fixture-key",
+    "maxAgeMs": 300000,
+    "nonceHex": "0909090909090909090909090909090909090909090909090909090909090909",
+    "nowMs": 1790294401000,
+    "pcrs": {
+        "0": "010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101",
+        "1": "020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202",
+        "2": "030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303"
+    },
+    "previousKeyIds": ["fixture-previous-key"],
+    "publicKeyBase64": null,
+    "rootSha256": "d71ae13f792676894bf8549178ea45acc360b1935e628f678d9e2f3befae9dfe",
+    "testOnly": true,
+    "timestamp": 1790294400000,
+    "userDataBase64": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnX5GwyaaFpFYdl7m9ft+aF3MG6GanWFe7rvTqEGNoojfQtaaRXWNmYbC9affj2Twoy2RlWkOTGFETJQC5/f93w=="
+}

package/src/__fixtures__/nitro-attestation/nonce-mismatch.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg+mTWJjdzf8nTM2L5oHpV431U8iAA0BKgTMK4nDXUNb2XAUrtR1sUMhYfhN2zFRWXdGjVcKvoQHBSl+VGlyS2tAvwpM77dC1VagmQzfONA83TTIId6j8NBpL+knXYzpVS

package/src/__fixtures__/nitro-attestation/root.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNh
+cmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAx
+MDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8g
+Um9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJ
+ONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsP
+a2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY
++F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
+MAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+
+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/P
+NwOH2sbZ/YY5Za+AsWQ2vgbabHJxYw==
+-----END CERTIFICATE-----

package/src/__fixtures__/nitro-attestation/stale-timestamp.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV03RAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhgUJxwm8doTkSFkGNunxxkpA1eYM+293d34HCJGUGHo3IJ5DhiXutU6jmiNNcNzpC15A5/MTdFiX9zX4YTXPkOjyoFpMAghMb9azjnCWCJtvg3xhxNLwLDaXUMziKbL2cP

package/src/__fixtures__/nitro-attestation/tampered-previous-key-ids.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V4ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg+mTWJjdzf8nTM2L5oHpV431U8iAA0BKgTMK4nDXUNb2XAUrtR1sUMhYfhN2zFRWXdGjVcKvoQHBSl+VGlyS2tAvwpM77dC1VagmQzfONA83TTIId6j8NBpL+knXYzpVS

package/src/__fixtures__/nitro-attestation/truncated-chain.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkIEKlpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWBWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY2pwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg0PSPR8DYb+KiEaIsFE6SHvGYPS56liqy4pZ+Uzs+WSjNImqTT4xLY4xokR4b4dxYvWmHK4xKxhBv1WNNg628VZrcnCYTkuU31tfNLQsThG6Kfrz7siuhI2yUo2xPcYDW

package/src/__fixtures__/nitro-attestation/valid.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg+mTWJjdzf8nTM2L5oHpV431U8iAA0BKgTMK4nDXUNb2XAUrtR1sUMhYfhN2zFRWXdGjVcKvoQHBSl+VGlyS2tAvwpM77dC1VagmQzfONA83TTIId6j8NBpL+knXYzpVS

package/src/__fixtures__/nitro-attestation/wrong-pcr0.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhgARS+35VntRGV3gL+wb/ujP6AR2T3i3MVSqF2UkwtDSfMDTkAoIY+VLu79Zk2Y579fzbjL8houukhehmXd5Xp6WiXowHjEJdlo/RZwRswHtB9YppGB9gxv3J64fMWTOAp

package/src/__fixtures__/nitro-attestation/wrong-root.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKCKlpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHtMIIB6TCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEBJ8TDzJLbNZ/uJqLrFm/zHS2TDLfb97e39EHwkfZ0xwE2/StOUKaKKyOhAEGIbKMILPR7zPUQdJ6Taz5qbU4ABER6YiycYopBTKrFnZS4z/Lhw+PAxoOllGUfNwrwjkGo2AwXjAdBgNVHQ4EFgQUVn+9f0Oa7MWFDZZPT8BZ3REubDswHwYDVR0jBBgwFoAUzY+QmTTCSOlx0H3DFcYcxnRR62cwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDaQAwZgIxALb+USDVCdSilLcxV9cqnNpGVKDTezY/mh9WGNy1xkyB73x35GplnmdYvRqKfBrXEgIxAKrAxvebS390zZrIBUUuifW0b0xafxuMdMrAKEv9ZYUj77dTwHxx5ZREbZ9oMCXRQGhjYWJ1bmRsZYJZAccwggHDMIIBSKADAgECAgEBMAoGCCqGSM49BAMDMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEe6EoC9fLj1w7BvlRr8NdgbOiODxslwtNshNYa4w/J1xq7yla+GQGzE5U+3fYVu4en1PhMCAKKE7JRF40Xoy5PWr9oqIYaiM9t/eh2zEigBtl5au7Rud96/m8556swayco0IwQDAdBgNVHQ4EFgQU9OLCHJG1VjDguCiHUMX4iunyE2EwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwMDaQAwZgIxANWY4PSaYRRwNx1U+W52KEZ1eyrtgo1WPUkeKCJ7EXyhZqftF9cQMeoIqi/OVbR3OAIxAMexIUP95FFx6HGZ4hC5ITW0kDDChAx06Za+Kl2XE7MZP/PrIj+bvE5Z5Hjlguwyp1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABIG3U3QGqwIou+Ea2HBCgmck0mjouJVHxryvXtX1BjelcxGfynbpzNgeC6a24/3GJa1ModVWez/r9Xbz4Zdgh8MW/GBG03kcClvfqA/rQStbiWL7TuY2HVMxfnIrMqO1OqNmMGQwHQYDVR0OBBYEFM2PkJk0wkjpcdB9wxXGHMZ0UetnMB8GA1UdIwQYMBaAFPTiwhyRtVYw4Lgoh1DF+Irp8hNhMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDmDS76TFJxb4PJTY0+VOcfVHBTEv315YWmvUxkdh0DDKbSRp4ycO9wq+qlzSs1hpgCMAmXov+6OE3B53xDLEE91MqDA4/9eiH++zpA21LMaqO/Y38ndJd1H8u80HzquF44impwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg7Uxjxl0oj51tI1I0PaYniKfmjtA1QL9mWMwEDBXtSsUOAkE/vLo9bIWkAngUbht+chS1XzPsCaRzWSNQ65RckLIAFkqF75vywIL/u85pTKulJtrxPSbVGVEj7Pz39fgu

package/src/__fixtures__/nitro-attestation-real/staging-nsm-document.json

@@ -0,0 +1,16 @@
+{
+    "description": "Real AWS Nitro NSM attestation captured from LearnCard staging (image vf84e57fe) on 2026-10-15. Public data only. The NSM encodes its payload as an indefinite-length CBOR map. Verify with the clock frozen at timestamp: the NSM leaf certificate is short-lived.",
+    "nonceHex": "692d4a147e49b91e150221b8f536034d7b8810cb8a360f83af8a327e714bbdbc",
+    "timestamp": 1792093180029,
+    "keyId": "escrow-staging-v1",
+    "moduleId": "i-0fccb146d74b9bf5c-enc01a140f184cca19a",
+    "measurements": {
+        "pcr0": "c91ac037a879afd1bd103e8a7433cc4d314676c203b143665e9e512217cbdbeb4d46879a1bae823b70422672dd2c57a6",
+        "pcr1": "4b4d5b3661b3efc12920900c80e126e4ce783c522de6c02a2a5bf7af3a2b9327b86776f188e4be1c1c404a129dbda493",
+        "pcr2": "682bd2dae49b3be11b1b015f8b8034e4eaedb416590d2857fa19b6ef5842674f04b81f88e25b94c3b6cbf9c28e3c0875"
+    },
+    "escrowPublicKeySpkiB64": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAErzuapPkQxSAb0oEQdYHWQIGXt8aSTKZwUWxrFoysw6WggnF8caCLNZiaFBeAfBd2PUty+/pXmgmpFsIo86zzcQ==",
+    "ledgerPublicKey": "BMxjZVpb2z5/5bA31+FfC3kl33AVSZcC34RQd0fzkJtK4RnOcdg43oN0DPoGcZnw31ExrFMvpq07y6O9w3njDF8=",
+    "measurementHash": "745eb1df7673be68893cf22617e5a8148409ab08d71c7cd22989eb4817602098",
+    "document": "hEShATgioFkR2r9pbW9kdWxlX2lkeCdpLTBmY2NiMTQ2ZDc0YjliZjVjLWVuYzAxYTE0MGYxODRjY2ExOWFmZGlnZXN0ZlNIQTM4NGl0aW1lc3RhbXAbAAABoUET0H1kcGNyc7AAWDDJGsA3qHmv0b0QPop0M8xNMUZ2wgOxQ2ZenlEiF8vb601Gh5obroI7cEImct0sV6YBWDBLTVs2YbPvwSkgkAyA4Sbkzng8Ui3mwCoqW/evOiuTJ7hndvGI5L4cHEBKEp29pJMCWDBoK9La5Js74RsbAV+LgDTk6u20FlkNKFf6GbbvWEJnTwS4H4jiW5TDtsv5wo48CHUDWDCHdzQclrpRivRoilEYMqdVWVPfdnV8avqfhVje297H9fhUlR7qO56Uy89NuaIgSEAEWDCDDFn0eaCK/GKuSfePY9SNWK68bQYB6Fd8DmPKGvZLoA6lgDfC2FG26rcI2nDokBUFWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABrY2VydGlmaWNhdGVZAn8wggJ7MIICAaADAgECAhABoUDxhMyhmgAAAABq0SM1MAoGCCqGSM49BAMDMIGOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxOTA3BgNVBAMMMGktMGZjY2IxNDZkNzRiOWJmNWMudXMtZWFzdC0xLmF3cy5uaXRyby1lbmNsYXZlczAeFw0yNjEwMTUxOTAyMTBaFw0yNjEwMTUyMjAyMTNaMIGTMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxPjA8BgNVBAMMNWktMGZjY2IxNDZkNzRiOWJmNWMtZW5jMDFhMTQwZjE4NGNjYTE5YS51cy1lYXN0LTEuYXdzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEQUmjXbzrUv+z5tKKnJnoiU5WQ8TIKnRghE359BanHkJ1XcvQyhy80RG8gGWU6p67xABadC1WTT+TABEyr1xXh9ZLkcVIodevouavkE1nYeMbESlaAaXoqQGkzNFa6CPDox0wGzAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwIGwDAKBggqhkjOPQQDAwNoADBlAjEAhn7o6xNy6u97/Lj/Yx/5h/LE/cZeIhglBjztLo8CPS4DkgGDmffM8QGwz2QhQ/XBAjBSuzRqMXGbW5argncwW5FKcl7Ru5tEgBWHPRNFZODPXj27LpgyHGDxTqakhs8ZCSJoY2FidW5kbGWEWQIVMIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTELMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYDVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4MTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZEh8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkFR+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYCMQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPWrfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6NIwLz3/ZZAsMwggK/MIICRaADAgECAhEA27BhW6cNsX+tzKWd6AVrJjAKBggqhkjOPQQDAzBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczAeFw0yNjEwMTEwOTMyNTVaFw0yNjEwMzExMDMyNTVaMGQxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKDAZBbWF6b24xDDAKBgNVBAsMA0FXUzE2MDQGA1UEAwwtZmFjM2M3MzYzZTdmN2Y0OC51cy1lYXN0LTEuYXdzLm5pdHJvLWVuY2xhdmVzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAECkUiV/cHWIva1ZXs7/i059Uki/70qS2TeACikoWzH2nrpcEGLtutLpDKh6wv8cmDBtdRxuiylKJqPQH+Ls8zHnvkXDbP8rgaAaUI7PGUxefauhh9RtqrBqKV2NqlDn0Bo4HVMIHSMBIGA1UdEwEB/wQIMAYBAf8CAQIwHwYDVR0jBBgwFoAUkCW1DdkFR+eWw5b6cp3PmanfS5YwHQYDVR0OBBYEFBYUDIYvDvEzrQPsWxa+ApXKgDgqMA4GA1UdDwEB/wQEAwIBhjBsBgNVHR8EZTBjMGGgX6BdhltodHRwOi8vYXdzLW5pdHJvLWVuY2xhdmVzLWNybC5zMy5hbWF6b25hd3MuY29tL2NybC9hYjQ5NjBjYy03ZDYzLTQyYmQtOWU5Zi01OTMzOGNiNjdmODQuY3JsMAoGCCqGSM49BAMDA2gAMGUCMQCqf7gyngg7h8CI1HhZkpPV2nQVHACp4vSETWvLr4wYIadIVkGrHOZ4ZYXebQoFM3gCMHnc42xP2LiRi6OCGMUdw/1tRBbnpDGJFvU+udcPJ/sb5834Z/JBDDTCXk+ABWS1a1kDGTCCAxUwggKboAMCAQICEQCqKgqUhulPlCPBk14hh8u8MAoGCCqGSM49BAMDMGQxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKDAZBbWF6b24xDDAKBgNVBAsMA0FXUzE2MDQGA1UEAwwtZmFjM2M3MzYzZTdmN2Y0OC51cy1lYXN0LTEuYXdzLm5pdHJvLWVuY2xhdmVzMB4XDTI2MTAxNTA4NTc0MVoXDTI2MTAyMDIzNTc0MVowgYkxPDA6BgNVBAMMMzRkMmEzNDRmYjE4M2ZkZjQuem9uYWwudXMtZWFzdC0xLmF3cy5uaXRyby1lbmNsYXZlczEMMAoGA1UECwwDQVdTMQ8wDQYDVQQKDAZBbWF6b24xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJXQTEQMA4GA1UEBwwHU2VhdHRsZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMBennhxsRIcgCRy4bv8b/y4Uj3YWKDPMAIStsdZE/mgHs18Mk1mAl0EyKniUcstdJVUYFWIzZ2Rut8TgHL2bWWPq7n3J2V4qp11bwxpGZ21b+dDsk0zk/Pw9BX0Nc+2CqOB6jCB5zASBgNVHRMBAf8ECDAGAQH/AgEBMB8GA1UdIwQYMBaAFBYUDIYvDvEzrQPsWxa+ApXKgDgqMB0GA1UdDgQWBBSwRNZ1QUudp4HF6bVvcH9k2aA/RTAOBgNVHQ8BAf8EBAMCAYYwgYAGA1UdHwR5MHcwdaBzoHGGb2h0dHA6Ly9jcmwtdXMtZWFzdC0xLWF3cy1uaXRyby1lbmNsYXZlcy5zMy51cy1lYXN0LTEuYW1hem9uYXdzLmNvbS9jcmwvMDIyYThlNjctYTc3MC00YmU3LWE0ZTItY2M3MDdhMTg4MmUyLmNybDAKBggqhkjOPQQDAwNoADBlAjEAthpv45w1mN+ND14kS+v+T1eZ2vtvMSnshe9LIUqgKtc4v/v8GqH624poty/DuQhEAjBhPxIWTL8vsC4+97ttO6II4IwtbaB3299Xh0D8EVFD47BiCbKMNybP1Epiy0ksG/tZAsMwggK/MIICRKADAgECAhQf4OoLEplf/bb8kbe33cjoAmmGjDAKBggqhkjOPQQDAzCBiTE8MDoGA1UEAwwzNGQyYTM0NGZiMTgzZmRmNC56b25hbC51cy1lYXN0LTEuYXdzLm5pdHJvLWVuY2xhdmVzMQwwCgYDVQQLDANBV1MxDzANBgNVBAoMBkFtYXpvbjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMRAwDgYDVQQHDAdTZWF0dGxlMB4XDTI2MTAxNTE5MDExMFoXDTI2MTAxNjE5MDExMFowgY4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMQ8wDQYDVQQKDAZBbWF6b24xDDAKBgNVBAsMA0FXUzE5MDcGA1UEAwwwaS0wZmNjYjE0NmQ3NGI5YmY1Yy51cy1lYXN0LTEuYXdzLm5pdHJvLWVuY2xhdmVzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEgQJsqRVfAVq/9cQflyUTMDJnYEmgAvTAYSkNSsJmy6BDRKW3X3bHfezpsAij7pglf2ruYM+ZbQvEDZ/6VH2DDdjiXLOpkQB8G21CRQNk9z+yEi5TI8H56uimhwnJQCyFo2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwICBDAdBgNVHQ4EFgQUzOQq6mhRBRHeImoGJZcsEsDMzGwwHwYDVR0jBBgwFoAUsETWdUFLnaeBxem1b3B/ZNmgP0UwCgYIKoZIzj0EAwMDaQAwZgIxAOOKFwil3QVaHRawm4W6h5wat4a4iK2px293FBnuEU3U+1PuybiRJ3PjO5YqsAAVdQIxAOlVOK+uJYI02/dCP/mIIM1QwvHXuT2eLb5Vx/dW0qC3X9vCuf00soLgSGDvtC7p5mpwdWJsaWNfa2V5WEEEzGNlWlvbPn/lsDfX4V8LeSXfcBVJlwLfhFB3R/OQm0rhGc5x2Djeg3QM+gZxmfDfUTGsUy+mrTvLo73DeeMMX2l1c2VyX2RhdGFYdKMAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASvO5qk+RDFIBvSgRB1gdZAgZe3xpJMpnBRbGsWjKzDpaCCcXxxoIs1mJoUF4B8F3Y9S3L7+leaCakWwijzrPNxAXFlc2Nyb3ctc3RhZ2luZy12MQKAZW5vbmNlWCBpLUoUfkm5HhUCIbj1NgNNe4gQy4o2D4OvijJ+cUu9vP9YYD4ZPjzyMa6yzUabADkXaJ8tUWjiB1aHmGSbiBubxhop/xNWgDq8mjG6Qq4LCnZfGPbS3AL8/XfFyOD5xPfOb58MmgGEibRpXUxc5YNQuZt6a7XRYfUDCBxCDm7f6wKUFQ=="
+}

package/src/escrow-attestation.test.ts

@@ -22,7 +22,12 @@ describe('verifyEnclaveAttestation', () => {
                 { ...attestation(), publicKey: ` ${publicKey}\n` },
                 { mode: 'software', pinnedPublicKeys: [`\n${publicKey} `] }
             )
-        ).resolves.toEqual({ mode: 'software', keyId: 'test-key', publicKey });
+        ).resolves.toEqual({
+            mode: 'software',
+            keyId: 'test-key',
+            previousKeyIds: [],
+            publicKey,
+        });
     });
     it('rejects an unknown key', async () => {
         await expect(
@@ -48,7 +53,7 @@ describe('verifyEnclaveAttestation', () => {
                     { ...attestation(), mode },
                     { mode: 'nitro', pinnedMeasurements: [] }
                 )
-            ).rejects.toThrow('Nitro attestation verification is not implemented yet');
+            ).rejects.toThrow(mode === 'software' ? 'mode mismatch' : 'nonce');
         }
     );
     it.each([

package/src/escrow-attestation.ts

@@ -1,5 +1,7 @@
 import { base64ToBuffer, bufferToBase64 } from './crypto';
 import type { EscrowAttestationPolicy } from './types';
+import type { VerifiedEnclaveIdentity } from './escrow-authority.types';
+import { NitroAttestationError, verifyNitroAttestationDocument } from './escrow-nitro-attestation';
 
 const isRecord = (value: unknown): value is Record<string, unknown> =>
     typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -19,15 +21,29 @@ const normalizePublicKey = (value: string): string => {
 /** Parse untrusted attestation data and enforce an explicit enclave trust policy. */
 export const verifyEnclaveAttestation = async (
     attestation: unknown,
-    policy: EscrowAttestationPolicy
-): Promise<{ publicKey: string; keyId: string; mode: 'software' | 'nitro' }> => {
-    const fields = ['mode', 'keyId', 'publicKey', 'measurements', 'document', 'issuedAt'];
+    policy: EscrowAttestationPolicy,
+    nonce?: Uint8Array
+): Promise<VerifiedEnclaveIdentity> => {
+    const isKeyId = (value: unknown): value is string =>
+        typeof value === 'string' && /^[A-Za-z0-9._-]{1,128}$/.test(value);
+    const fields = [
+        'mode',
+        'keyId',
+        'previousKeyIds',
+        'publicKey',
+        'measurements',
+        'document',
+        'issuedAt',
+    ];
     if (
         !isRecord(attestation) ||
         Object.keys(attestation).some(key => !fields.includes(key)) ||
         (attestation.mode !== 'software' && attestation.mode !== 'nitro') ||
-        typeof attestation.keyId !== 'string' ||
-        !/^[A-Za-z0-9._-]{1,128}$/.test(attestation.keyId) ||
+        !isKeyId(attestation.keyId) ||
+        (attestation.previousKeyIds !== undefined &&
+            (!Array.isArray(attestation.previousKeyIds) ||
+                attestation.previousKeyIds.length > 3 ||
+                !attestation.previousKeyIds.every(isKeyId))) ||
         typeof attestation.publicKey !== 'string' ||
         !isRecord(attestation.measurements) ||
         Object.entries(attestation.measurements).some(
@@ -45,6 +61,51 @@ export const verifyEnclaveAttestation = async (
     ) {
         throw new Error('Invalid escrow attestation');
     }
+    const plaintextPreviousKeyIds = attestation.previousKeyIds ?? [];
+    if (attestation.mode !== policy.mode) throw new Error('Escrow attestation mode mismatch');
+    if (policy.mode === 'nitro') {
+        if (!nonce) throw new NitroAttestationError('nonce');
+        const verified = await verifyNitroAttestationDocument(attestation.document, {
+            expectedNonce: nonce,
+            policy,
+        });
+        try {
+            if (normalizePublicKey(attestation.publicKey) !== verified.escrowPublicKeySpkiB64) {
+                throw new NitroAttestationError('user-data');
+            }
+        } catch {
+            throw new NitroAttestationError('user-data');
+        }
+        // The wire JSON's `keyId` — the value a client actually seals new
+        // envelopes to — must match what is bound inside the signed document
+        // whenever the document carries one (legacy user_data never did, so
+        // there is nothing to cross-check there; keep today's behaviour).
+        if (verified.keyId !== undefined && verified.keyId !== attestation.keyId) {
+            throw new NitroAttestationError('user-data');
+        }
+        // Likewise the wire JSON's `previousKeyIds` must exactly match what is
+        // bound inside the signed document — never trust the plaintext value alone.
+        if (
+            plaintextPreviousKeyIds.length !== verified.previousKeyIds.length ||
+            !plaintextPreviousKeyIds.every((id, index) => id === verified.previousKeyIds[index])
+        ) {
+            throw new NitroAttestationError('user-data');
+        }
+        return {
+            publicKey: verified.escrowPublicKeySpkiB64,
+            keyId: attestation.keyId,
+            previousKeyIds: verified.previousKeyIds,
+            mode: 'nitro',
+            ...(verified.keyId && verified.ledgerPublicKey && verified.measurementHash
+                ? {
+                      authority: {
+                          ledgerPublicKey: verified.ledgerPublicKey,
+                          measurement: verified.measurementHash,
+                      },
+                  }
+                : {}),
+        };
+    }
     const publicKey = normalizePublicKey(attestation.publicKey);
     await crypto.subtle.importKey(
         'spki',
@@ -53,12 +114,13 @@ export const verifyEnclaveAttestation = async (
         false,
         []
     );
-    if (policy.mode === 'nitro') {
-        throw new Error('Nitro attestation verification is not implemented yet');
-    }
-    if (attestation.mode !== policy.mode) throw new Error('Escrow attestation mode mismatch');
     if (!policy.pinnedPublicKeys.some(pin => normalizePublicKey(pin) === publicKey)) {
         throw new Error('Escrow attestation public key is not trusted');
     }
-    return { publicKey, keyId: attestation.keyId, mode: attestation.mode };
+    return {
+        publicKey,
+        keyId: attestation.keyId,
+        previousKeyIds: plaintextPreviousKeyIds,
+        mode: attestation.mode,
+    };
 };