@learncard/sss-key-manager 0.2.1 → 0.2.2

package/src/escrow-crypto.ts

@@ -28,13 +28,22 @@ export interface EscrowEnvelope {
     ciphertext: string;
 }
 
-/** Recovery share bound to an identity and a positive share version. */
+/** P9.1 (attack C): the app's compiled template languages. Keep in lockstep with
+ * apps/learn-card-app/src/i18n's SUPPORTED_LANGUAGES and the Rust RECOVERY_LANGUAGES. */
+export const RECOVERY_LANGUAGES = ['en', 'es', 'fr', 'ar'] as const;
+
+/** Recovery share bound to an identity and a positive share version.
+ * `recoveryEmail`/`recoveryLanguage`: bound by the user's own device at
+ * enrollment, never by lca-api. Always both-present or both-absent; changing
+ * the address requires a fresh `replace` enrollment, not an edit. */
 export interface EscrowBlobPlaintext {
     version: typeof ESCROW_ENVELOPE_VERSION;
     recoveryShare: string;
     did: string;
     shareVersion: number;
     pinVerifier?: string;
+    recoveryEmail?: string;
+    recoveryLanguage?: string;
 }
 
 /** Released recovery share additionally bound to its recovery hold. */
@@ -105,6 +114,34 @@ export const parseEscrowBlobPlaintext = (value: unknown): EscrowBlobPlaintext =>
         throw new Error('Invalid escrow shareVersion');
     }
 
+    // P9.1: paired requirement; deliberately conservative email shape (not full
+    // RFC 5322/IDN), matching the enclave's `normalize()` exactly.
+    if ((value.recoveryEmail !== undefined) !== (value.recoveryLanguage !== undefined)) {
+        throw new Error('Invalid escrow recoveryEmail');
+    }
+    let recoveryContact: Pick<EscrowBlobPlaintext, 'recoveryEmail' | 'recoveryLanguage'> = {};
+    if (value.recoveryEmail !== undefined) {
+        const email = requireString(value, 'recoveryEmail', { min: 3, max: 254 })
+            .trim()
+            .toLowerCase();
+        const at = email.split('@');
+        if (
+            !/^[\x21-\x7e]+$/.test(email) ||
+            at.length !== 2 ||
+            at[0].length === 0 ||
+            at[1].length === 0 ||
+            !at[1].includes('.') ||
+            at[1].startsWith('.') ||
+            at[1].endsWith('.')
+        ) {
+            throw new Error('Invalid escrow recoveryEmail');
+        }
+        const language = requireString(value, 'recoveryLanguage', { min: 2, max: 2 });
+        if (!(RECOVERY_LANGUAGES as readonly string[]).includes(language)) {
+            throw new Error('Invalid escrow recoveryLanguage');
+        }
+        recoveryContact = { recoveryEmail: email, recoveryLanguage: language };
+    }
     return {
         version: ESCROW_ENVELOPE_VERSION,
         recoveryShare: requireString(value, 'recoveryShare', {
@@ -123,6 +160,7 @@ export const parseEscrowBlobPlaintext = (value: unknown): EscrowBlobPlaintext =>
                   }).toLowerCase(),
               }
             : {}),
+        ...recoveryContact,
     };
 };
 

package/src/escrow-enrollment-intent.test.ts

@@ -0,0 +1,224 @@
+// @vitest-environment node
+import { readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+import { verifyAsync } from '@noble/ed25519';
+import {
+    encodeEscrowEnrollmentIntent,
+    signEscrowEnrollmentIntent,
+    getEscrowBlobIdentity,
+} from './escrow-enrollment-intent';
+import type {
+    EscrowEnrollmentIntent,
+    SignedEscrowEnrollmentIntent,
+} from './escrow-enrollment-intent.types';
+import type { EscrowEnvelope } from './escrow-crypto';
+
+interface Vector extends SignedEscrowEnrollmentIntent {
+    seedHex: string;
+    publicKeyHex: string;
+    canonicalHex: string;
+    sourceFixtureIndex: number;
+    targetFixtureIndex: number;
+}
+const vector: Vector = JSON.parse(
+    readFileSync(
+        new URL('./__fixtures__/escrow-enrollment-intent-v1.json', import.meta.url),
+        'utf8'
+    )
+);
+const envelopes: { blobs: { envelope: EscrowEnvelope }[] } = JSON.parse(
+    readFileSync(new URL('./__fixtures__/escrow-vectors.json', import.meta.url), 'utf8')
+);
+
+describe('owner-signed escrow enrollment intent', () => {
+    it('matches the shared Rust message, raw Ed25519 signature and envelope identities', async () => {
+        const message = encodeEscrowEnrollmentIntent(vector.intent);
+        expect(Buffer.from(message).toString('hex')).toBe(vector.canonicalHex);
+        expect(await signEscrowEnrollmentIntent(vector.intent, vector.seedHex)).toEqual({
+            intent: vector.intent,
+            signature: vector.signature,
+        });
+        expect(
+            await verifyAsync(
+                Buffer.from(vector.signature, 'base64'),
+                message,
+                vector.publicKeyHex,
+                { zip215: false }
+            )
+        ).toBe(true);
+        expect(
+            await getEscrowBlobIdentity(envelopes.blobs[vector.sourceFixtureIndex].envelope)
+        ).toBe(vector.intent.sourceBlobIdentity);
+        expect(
+            await getEscrowBlobIdentity(envelopes.blobs[vector.targetFixtureIndex].envelope)
+        ).toBe(vector.intent.targetBlobIdentity);
+    });
+
+    it('refuses a nonowner seed and never needs an external DID resolver', async () => {
+        await expect(signEscrowEnrollmentIntent(vector.intent, '99'.repeat(32))).rejects.toThrow();
+        for (const did of [
+            'did:web:attacker.test',
+            `${vector.intent.did}#key`,
+            'did:key:uZm9v',
+            vector.intent.did.replace('z6Mk', 'z0Mk'),
+        ]) {
+            expect(() => encodeEscrowEnrollmentIntent({ ...vector.intent, did })).toThrow();
+        }
+        await expect(
+            signEscrowEnrollmentIntent(vector.intent, vector.seedHex + '00')
+        ).rejects.toThrow();
+        await expect(
+            signEscrowEnrollmentIntent(vector.intent, vector.seedHex + '\n')
+        ).rejects.toThrow();
+    });
+
+    it('snapshots intent before awaiting so caller mutation cannot change signed return data', async () => {
+        const intent = { ...vector.intent };
+        const pending = signEscrowEnrollmentIntent(intent, vector.seedHex);
+        intent.tenant = 'attacker';
+        intent.allowRewrap = false;
+        const signed = await pending;
+        expect(signed.intent).toEqual(vector.intent);
+        expect(signed.signature).toBe(vector.signature);
+    });
+
+    it.each([
+        { tenant: 'other' },
+        { authorityGeneration: 'g3' },
+        { expectedEnrollmentVersion: 8 },
+        { action: 'replace', recoveryEmail: 'owner@example.com', recoveryLanguage: 'en' },
+        { sourceBlobIdentity: '11'.repeat(32) },
+        { targetBlobIdentity: '22'.repeat(32) },
+        { shareVersion: 43 },
+        { enrollmentEpoch: 5 },
+        { requestId: 'other' },
+        { allowRewrap: false },
+    ] satisfies Partial<EscrowEnrollmentIntent>[])(
+        'binds signed field mutation %j',
+        async mutation => {
+            const message = encodeEscrowEnrollmentIntent({ ...vector.intent, ...mutation });
+            expect(
+                await verifyAsync(
+                    Buffer.from(vector.signature, 'base64'),
+                    message,
+                    vector.publicKeyHex,
+                    { zip215: false }
+                )
+            ).toBe(false);
+        }
+    );
+
+    it.each([
+        { version: 1 },
+        { version: 3 },
+        { tenant: '' },
+        { tenant: 'a'.repeat(129) },
+        { tenant: 'tenant\0evil' },
+        { tenant: 'tenant\n' },
+        { requestId: 'request\u2028' },
+        { targetBlobIdentity: 'ab'.repeat(32) + '\n' },
+        { expectedEnrollmentVersion: -1 },
+        { expectedEnrollmentVersion: Number.MAX_SAFE_INTEGER + 1 },
+        { expectedEnrollmentVersion: 1.5 },
+        { shareVersion: 0 },
+        { shareVersion: 2 ** 32 },
+        { enrollmentEpoch: 0 },
+        { enrollmentEpoch: Infinity },
+        { sourceBlobIdentity: undefined },
+        { targetBlobIdentity: 'AB'.repeat(32) },
+        { requestId: 'x#y' },
+        { allowRewrap: undefined },
+        { action: 'rewrap' },
+        { pinAction: 'clear' },
+        { extra: 'unsigned-field' },
+        { recoveryLanguage: 'en' },
+        { recoveryEmail: 'owner@example.com' },
+        {
+            action: 'enroll',
+            sourceBlobIdentity: null,
+            recoveryEmail: 'owner@example.com',
+            recoveryLanguage: 'xx',
+        },
+        {
+            action: 'enroll',
+            sourceBlobIdentity: null,
+            recoveryEmail: 'not-an-email',
+            recoveryLanguage: 'en',
+        },
+        { recoveryEmail: 'owner@example.com', recoveryLanguage: 'en' },
+    ])('rejects invalid wire input %j', mutation => {
+        // Exercise runtime guards, rather than pretending unknown input is typed.
+        const input: unknown = { ...vector.intent, ...mutation };
+        expect(() => encodeEscrowEnrollmentIntent(input as EscrowEnrollmentIntent)).toThrow();
+    });
+
+    it('accepts safe-integer boundaries and explicit nulls, not omitted fields', () => {
+        const intent: EscrowEnrollmentIntent = {
+            ...vector.intent,
+            action: 'enroll',
+            sourceBlobIdentity: null,
+            expectedEnrollmentVersion: Number.MAX_SAFE_INTEGER,
+            enrollmentEpoch: Number.MAX_SAFE_INTEGER,
+            shareVersion: 0xffffffff,
+            recoveryEmail: 'owner@example.com',
+            recoveryLanguage: 'en',
+        };
+        expect(() => encodeEscrowEnrollmentIntent(intent)).not.toThrow();
+        const { sourceBlobIdentity: omitted, ...missing } = intent;
+        expect(omitted).toBeNull();
+        expect(() => encodeEscrowEnrollmentIntent(missing as EscrowEnrollmentIntent)).toThrow();
+    });
+
+    it('pins action/PIN enum tags and separates disable from enrollment', () => {
+        const disable: EscrowEnrollmentIntent = {
+            ...vector.intent,
+            action: 'disable',
+            targetBlobIdentity: null,
+            allowRewrap: false,
+        };
+        expect(() => encodeEscrowEnrollmentIntent(disable)).not.toThrow();
+        expect(() => encodeEscrowEnrollmentIntent({ ...disable, allowRewrap: true })).toThrow();
+        for (const pinAction of ['set', 'change', 'clear', 'keep'] as const) {
+            expect(() =>
+                encodeEscrowEnrollmentIntent({
+                    ...vector.intent,
+                    action: 'replace',
+                    pinAction,
+                    recoveryEmail: 'owner@example.com',
+                    recoveryLanguage: 'en',
+                })
+            ).not.toThrow();
+        }
+        expect(() =>
+            encodeEscrowEnrollmentIntent({
+                ...vector.intent,
+                targetBlobIdentity: vector.intent.sourceBlobIdentity,
+            })
+        ).toThrow();
+    });
+
+    it('preserves blob identity under Q/-Q, but not ciphertext substitution', async () => {
+        const original = envelopes.blobs[0].envelope;
+        const point = Buffer.from(original.ephemeralPublicKey, 'base64');
+        const prime = BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff');
+        const y = BigInt(`0x${point.subarray(33).toString('hex')}`);
+        Buffer.from((prime - y).toString(16).padStart(64, '0'), 'hex').copy(point, 33);
+        expect(
+            await getEscrowBlobIdentity({
+                ...original,
+                ephemeralPublicKey: point.toString('base64'),
+            })
+        ).toBe(vector.intent.sourceBlobIdentity);
+        const ciphertext = Buffer.from(original.ciphertext, 'base64');
+        ciphertext[0] ^= 1;
+        expect(
+            await getEscrowBlobIdentity({ ...original, ciphertext: ciphertext.toString('base64') })
+        ).not.toBe(vector.intent.sourceBlobIdentity);
+        await expect(
+            getEscrowBlobIdentity({
+                ...original,
+                ephemeralPublicKey: Buffer.alloc(65, 4).toString('base64'),
+            })
+        ).rejects.toThrow();
+    });
+});

package/src/escrow-enrollment-intent.ts

@@ -0,0 +1,236 @@
+import { ExtendedPoint, getPublicKeyAsync, signAsync } from '@noble/ed25519';
+import { base64ToBuffer, bufferToBase64, bytesToHex, hexToBytes } from './crypto';
+import { parseEscrowEnvelope } from './escrow-crypto';
+import type { EscrowEnvelope } from './escrow-crypto';
+import type {
+    EscrowEnrollmentIntent,
+    SignedEscrowEnrollmentIntent,
+} from './escrow-enrollment-intent.types';
+
+// P9.1: bumped alongside `version` so the two new recovery fields can never be
+// verified against the pre-PR3 byte layout. Must match Rust's INTENT_DOMAIN exactly.
+export const ESCROW_ENROLLMENT_INTENT_DOMAIN = 'learncard-escrow-enrollment-intent-v2\0';
+const BASE58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const FIELDS = [
+    'version',
+    'tenant',
+    'did',
+    'authorityGeneration',
+    'expectedEnrollmentVersion',
+    'action',
+    'sourceBlobIdentity',
+    'targetBlobIdentity',
+    'pinAction',
+    'shareVersion',
+    'enrollmentEpoch',
+    'requestId',
+    'allowRewrap',
+    'recoveryEmail',
+    'recoveryLanguage',
+];
+const ACTIONS = ['enroll', 'replace', 'disable', 'carry'];
+const PIN_ACTIONS = ['set', 'change', 'clear', 'keep'];
+// P9.1 (attack C): the app's compiled template languages. Keep in lockstep with
+// apps/learn-card-app/src/i18n's SUPPORTED_LANGUAGES and the Rust RECOVERY_LANGUAGES.
+const RECOVERY_LANGUAGES = ['en', 'es', 'fr', 'ar'];
+
+const requireIntent = (condition: boolean): void => {
+    if (!condition) throw new Error('Invalid escrow enrollment intent');
+};
+// JS `$` also matches before a final newline: require a complete match.
+const matches = (value: unknown, pattern: RegExp): boolean =>
+    typeof value === 'string' && pattern.exec(value)?.[0] === value;
+const utf8 = (value: string): Uint8Array<ArrayBuffer> => new TextEncoder().encode(value);
+const integer = (value: number, width: 4 | 8): Uint8Array<ArrayBuffer> => {
+    requireIntent(
+        Number.isSafeInteger(value) && value >= 0 && (width === 8 || value <= 0xffffffff)
+    );
+    const bytes = new Uint8Array(width);
+    const view = new DataView(bytes.buffer);
+    if (width === 4) view.setUint32(0, value, false);
+    else view.setBigUint64(0, BigInt(value), false);
+    return bytes;
+};
+const join = (fields: Uint8Array[]): Uint8Array<ArrayBuffer> => {
+    const result = new Uint8Array(fields.reduce((length, field) => length + field.length, 0));
+    let offset = 0;
+    for (const field of fields) {
+        result.set(field, offset);
+        offset += field.length;
+    }
+    return result;
+};
+const hashBytes = (value: string | null): Uint8Array<ArrayBuffer> => {
+    if (value === null) return new Uint8Array();
+    requireIntent(matches(value, /^[0-9a-f]{64}$/));
+    return new Uint8Array(hexToBytes(value));
+};
+
+/** Fixed-size Ed25519 multicodec decoder, not a network DID resolver. */
+const didPublicKey = (did: string): Uint8Array<ArrayBuffer> => {
+    requireIntent(typeof did === 'string' && did.startsWith('did:key:z') && did.length === 56);
+    let value = 0n;
+    for (const char of did.slice(9)) {
+        const digit = BASE58.indexOf(char);
+        requireIntent(digit >= 0);
+        value = value * 58n + BigInt(digit);
+    }
+    const bytes = new Uint8Array(34);
+    for (let i = 33; i >= 0; i--) {
+        bytes[i] = Number(value & 255n);
+        value >>= 8n;
+    }
+    // Fixed 47-digit length plus nonzero ed01 prefix excludes leading-zero aliases.
+    requireIntent(value === 0n && bytes[0] === 0xed && bytes[1] === 0x01);
+    const key = bytes.slice(2);
+    try {
+        requireIntent(!ExtendedPoint.fromHex(key, false).isSmallOrder());
+    } catch {
+        throw new Error('Invalid escrow enrollment intent');
+    }
+    return key;
+};
+
+/** Produce the exact Rust-verified V1 message, never JSON or a prehashed signature. */
+export const encodeEscrowEnrollmentIntent = (
+    intent: EscrowEnrollmentIntent
+): Uint8Array<ArrayBuffer> => {
+    requireIntent(typeof intent === 'object' && intent !== null && !Array.isArray(intent));
+    requireIntent(
+        Object.keys(intent).length === FIELDS.length &&
+            FIELDS.every(field => Object.prototype.hasOwnProperty.call(intent, field))
+    );
+    requireIntent(intent.version === 2 && typeof intent.allowRewrap === 'boolean');
+    requireIntent(matches(intent.tenant, /^[A-Za-z0-9_-]{1,128}$/));
+    requireIntent(matches(intent.authorityGeneration, /^[A-Za-z0-9_-]{1,128}$/));
+    requireIntent(matches(intent.requestId, /^[A-Za-z0-9._-]{1,112}$/));
+    didPublicKey(intent.did);
+    const action = ACTIONS.indexOf(intent.action);
+    const pin = PIN_ACTIONS.indexOf(intent.pinAction);
+    requireIntent(action >= 0 && pin >= 0 && intent.shareVersion > 0 && intent.enrollmentEpoch > 0);
+    const source = hashBytes(intent.sourceBlobIdentity);
+    const target = hashBytes(intent.targetBlobIdentity);
+    if (intent.action === 'enroll') requireIntent(source.length === 0 && target.length === 32);
+    else if (intent.action === 'disable')
+        requireIntent(
+            source.length === 32 &&
+                target.length === 0 &&
+                intent.pinAction === 'keep' &&
+                !intent.allowRewrap
+        );
+    else
+        requireIntent(
+            source.length === 32 &&
+                target.length === 32 &&
+                intent.sourceBlobIdentity !== intent.targetBlobIdentity
+        );
+    if (intent.action === 'carry') requireIntent(intent.pinAction === 'keep');
+    // P9.1 (attack C): email/language are deliberately conservative (not full
+    // RFC 5322/IDN) and paired; Enroll/Replace require them, Disable/Carry forbid them.
+    if (intent.recoveryEmail === null) {
+        requireIntent(
+            intent.recoveryLanguage === null &&
+                (intent.action === 'disable' || intent.action === 'carry')
+        );
+    } else {
+        requireIntent(intent.action === 'enroll' || intent.action === 'replace');
+        requireIntent(
+            matches(intent.recoveryEmail, /^[\x21-\x7e]{3,254}$/) &&
+                intent.recoveryEmail === intent.recoveryEmail.trim().toLowerCase()
+        );
+        const at = intent.recoveryEmail.split('@');
+        requireIntent(
+            at.length === 2 &&
+                at[0].length > 0 &&
+                at[1].length > 0 &&
+                at[1].includes('.') &&
+                !at[1].startsWith('.') &&
+                !at[1].endsWith('.')
+        );
+        requireIntent(
+            intent.recoveryLanguage !== null && RECOVERY_LANGUAGES.includes(intent.recoveryLanguage)
+        );
+    }
+    const fields = [
+        integer(intent.version, 4),
+        utf8(intent.tenant),
+        utf8(intent.did),
+        utf8(intent.authorityGeneration),
+        integer(intent.expectedEnrollmentVersion, 8),
+        Uint8Array.of(action),
+        source,
+        target,
+        Uint8Array.of(pin),
+        integer(intent.shareVersion, 4),
+        integer(intent.enrollmentEpoch, 8),
+        utf8(intent.requestId),
+        Uint8Array.of(Number(intent.allowRewrap)),
+        intent.recoveryEmail === null ? new Uint8Array() : utf8(intent.recoveryEmail),
+        intent.recoveryLanguage === null ? new Uint8Array() : utf8(intent.recoveryLanguage),
+    ];
+    return join([
+        utf8(ESCROW_ENROLLMENT_INTENT_DOMAIN),
+        ...fields.flatMap(field => [integer(field.length, 4), field]),
+    ]);
+};
+
+/** Sign with the account's 32-byte Ed25519 seed. Never needed for recovery itself.
+ * The caller must obtain generation/current version from an attested authority
+ * response and construct the exact operation it intends; signing is not consent UI.
+ */
+export const signEscrowEnrollmentIntent = async (
+    intent: EscrowEnrollmentIntent,
+    privateKey: string
+): Promise<SignedEscrowEnrollmentIntent> => {
+    // Snapshot before the first await so caller mutation cannot alter returned intent.
+    encodeEscrowEnrollmentIntent(intent);
+    const snapshot = { ...intent };
+    const message = encodeEscrowEnrollmentIntent(snapshot);
+    requireIntent(matches(privateKey, /^[0-9a-f]{64}$/i));
+    const seed = hexToBytes(privateKey);
+    try {
+        const publicKey = await getPublicKeyAsync(seed);
+        const expected = didPublicKey(snapshot.did);
+        requireIntent(publicKey.every((byte, index) => byte === expected[index]));
+        const signature = await signAsync(message, seed);
+        return { intent: snapshot, signature: bufferToBase64(new Uint8Array(signature).buffer) };
+    } finally {
+        seed.fill(0);
+    }
+};
+
+/** Canonical blob identity matches Rust, including Q/-Q ECDH equivalence. */
+export const getEscrowBlobIdentity = async (input: EscrowEnvelope): Promise<string> => {
+    const envelope = parseEscrowEnvelope(input);
+    const decode = (value: string): Uint8Array<ArrayBuffer> => {
+        const bytes = new Uint8Array(base64ToBuffer(value));
+        requireIntent(bufferToBase64(bytes.buffer) === value);
+        return bytes;
+    };
+    const point = decode(envelope.ephemeralPublicKey);
+    const salt = decode(envelope.salt);
+    const iv = decode(envelope.iv);
+    const ciphertext = decode(envelope.ciphertext);
+    requireIntent(
+        point.length === 65 &&
+            point[0] === 4 &&
+            salt.length === 32 &&
+            iv.length === 12 &&
+            ciphertext.length >= 16
+    );
+    await crypto.subtle.importKey('raw', point, { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+    const fields = [
+        Uint8Array.of(1),
+        utf8(envelope.algorithm),
+        utf8(envelope.keyId),
+        point.slice(1, 33),
+        salt,
+        iv,
+        ciphertext,
+    ];
+    const message = join([
+        utf8('learncard-escrow-blob-id-v1\0'),
+        ...fields.flatMap(field => [integer(field.length, 8), field]),
+    ]);
+    return bytesToHex(new Uint8Array(await crypto.subtle.digest('SHA-256', message)));
+};

package/src/escrow-enrollment-intent.types.ts

@@ -0,0 +1,28 @@
+/** V2 owner authorization, distinct from authentication and from recovery. */
+export interface EscrowEnrollmentIntent {
+    version: 2;
+    tenant: string;
+    did: string;
+    authorityGeneration: string;
+    expectedEnrollmentVersion: number;
+    action: 'enroll' | 'replace' | 'disable' | 'carry';
+    sourceBlobIdentity: string | null;
+    targetBlobIdentity: string | null;
+    pinAction: 'set' | 'change' | 'clear' | 'keep';
+    shareVersion: number;
+    enrollmentEpoch: number;
+    requestId: string;
+    allowRewrap: boolean;
+    /** P9.1 (attack C): required (and must match the blob) on enroll/replace;
+     *  must be null on disable/carry (the enclave carries the prior value forward).
+     *  Changing the address requires a fresh signed `replace` intent, not an edit. */
+    recoveryEmail: string | null;
+    /** One of the app's compiled template languages (currently en/es/fr/ar). */
+    recoveryLanguage: string | null;
+}
+
+/** Signature is canonical padded standard base64 of raw Ed25519 R || S. */
+export interface SignedEscrowEnrollmentIntent {
+    intent: EscrowEnrollmentIntent;
+    signature: string;
+}

package/src/escrow-nitro-attestation.test.ts

@@ -202,3 +202,75 @@ describe('FakeNsm Nitro attestation', () => {
         });
     });
 });
+
+describe('real AWS Nitro attestation', () => {
+    const real = JSON.parse(
+        readFileSync(
+            new URL(
+                './__fixtures__/nitro-attestation-real/staging-nsm-document.json',
+                import.meta.url
+            ),
+            'utf8'
+        )
+    ) as {
+        nonceHex: string;
+        timestamp: number;
+        keyId: string;
+        measurements: { pcr0: string; pcr1: string; pcr2: string };
+        escrowPublicKeySpkiB64: string;
+        measurementHash: string;
+        document: string;
+    };
+    const realNonce = Uint8Array.from(real.nonceHex.match(/../g)!, byte => parseInt(byte, 16));
+    const realOptions = {
+        expectedNonce: realNonce,
+        policy: { mode: 'nitro' as const, pinnedMeasurements: [real.measurements] },
+        now: real.timestamp,
+    };
+
+    it('uses the indefinite-length payload map the NSM actually emits', () => {
+        const cose = decode(base64ToBuffer(real.document), { useMaps: true }) as unknown[];
+        expect((cose[2] as Uint8Array)[0]).toBe(0xbf);
+    });
+
+    it('verifies against the default AWS root, nonce and pinned measurements', async () => {
+        await expect(
+            verifyNitroAttestationDocument(real.document, realOptions)
+        ).resolves.toMatchObject({
+            keyId: real.keyId,
+            escrowPublicKeySpkiB64: real.escrowPublicKeySpkiB64,
+            measurementHash: real.measurementHash,
+            timestamp: real.timestamp,
+        });
+    });
+
+    it('still rejects a real document with a different nonce or unpinned measurements', async () => {
+        await expect(
+            verifyNitroAttestationDocument(real.document, {
+                ...realOptions,
+                expectedNonce: new Uint8Array(32),
+            })
+        ).rejects.toMatchObject({ reason: 'nonce' });
+        await expect(
+            verifyNitroAttestationDocument(real.document, {
+                ...realOptions,
+                policy: { mode: 'nitro', pinnedMeasurements: [measurement] },
+            })
+        ).rejects.toMatchObject({ reason: 'pcr' });
+    });
+
+    it('keeps rejecting indefinite-length encoding outside the signed payload', async () => {
+        const cose = decode(base64ToBuffer(real.document), { useMaps: true }) as unknown[];
+        const indefiniteEnvelope = new Uint8Array([
+            0x9f,
+            ...encode(cose[0]),
+            ...encode(cose[1]),
+            ...encode(cose[2]),
+            ...encode(cose[3]),
+            0xff,
+        ]);
+        await expect(
+            verifyNitroAttestationDocument(bufferToBase64(indefiniteEnvelope.buffer), realOptions)
+        ).rejects.toMatchObject({ reason: 'cbor' });
+    });
+});