@super-protocol/addons-tee 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (58) hide show
  1. package/.editorconfig +15 -0
  2. package/.eslintrc.json +61 -0
  3. package/.prettierignore +3 -0
  4. package/.prettierrc +15 -0
  5. package/README.md +4 -0
  6. package/bindings/sgx-native/README.md +1 -0
  7. package/bindings/sgx-native/build/Release/libdcap_quoteprov.so.1 +0 -0
  8. package/bindings/sgx-native/build/Release/libmbedcrypto_gramine.so.6 +0 -0
  9. package/bindings/sgx-native/build/Release/libmbedx509_gramine.so.1 +0 -0
  10. package/bindings/sgx-native/build/Release/libsgx_dcap_quoteverify.so.1 +0 -0
  11. package/bindings/sgx-native/build/Release/libsgx_default_qcnl_wrapper.so.1 +0 -0
  12. package/bindings/sgx-native/build/Release/libsgx_urts.so.1 +0 -0
  13. package/bindings/sgx-native/build/Release/libsgx_util.so +0 -0
  14. package/bindings/sgx-native/build/Release/sgx_native.node +0 -0
  15. package/bindings/sgx-native/index.js +7 -0
  16. package/bindings/sgx-native/node.manifest.template +59 -0
  17. package/bindings/sgx-native/package-lock.json +23 -0
  18. package/bindings/sgx-native/package.json +19 -0
  19. package/bindings/sgx-native/run_tests.sh +10 -0
  20. package/bindings/sgx-native/test_certs/attestation/cert.der +0 -0
  21. package/bindings/sgx-native/test_certs/attestation/cert.pem +124 -0
  22. package/bindings/sgx-native/test_certs/attestation/cert_maliciously.der +0 -0
  23. package/bindings/sgx-native/test_certs/attestation/cert_maliciously.pem +124 -0
  24. package/bindings/sgx-native/test_certs/attestation/cert_without_quote.der +0 -0
  25. package/bindings/sgx-native/test_certs/attestation/cert_without_quote.pem +20 -0
  26. package/bindings/sgx-native/test_certs/attestation/cert_wrong_hash.der +0 -0
  27. package/bindings/sgx-native/test_certs/attestation/cert_wrong_hash.pem +124 -0
  28. package/bindings/sgx-native/test_certs/ssl/expired.pem +68 -0
  29. package/bindings/sgx-native/test_certs/ssl/hostnameTest.pem +22 -0
  30. package/bindings/sgx-native/test_certs/ssl/multipleHost.pem +62 -0
  31. package/bindings/sgx-native/test_certs/ssl/noHost.pem +61 -0
  32. package/bindings/sgx-native/test_certs/ssl/noIntermidiate.pem +62 -0
  33. package/bindings/sgx-native/test_certs/ssl/revoked.pem +68 -0
  34. package/bindings/sgx-native/test_certs/ssl/untrusted.pem +65 -0
  35. package/bindings/sgx-native/test_certs/ssl/valid.pem +94 -0
  36. package/dist/index.d.ts +2 -0
  37. package/dist/index.js +32 -0
  38. package/dist/quote-validator/constants.d.ts +3 -0
  39. package/dist/quote-validator/constants.js +7 -0
  40. package/dist/quote-validator/index.d.ts +1 -0
  41. package/dist/quote-validator/index.js +9 -0
  42. package/dist/quote-validator/sgx-untrasted-validator.d.ts +12 -0
  43. package/dist/quote-validator/sgx-untrasted-validator.js +150 -0
  44. package/dist/quote-validator/sgx-untrasted-validator.spec.d.ts +1 -0
  45. package/dist/sgx-native-module/consts.d.ts +105 -0
  46. package/dist/sgx-native-module/consts.js +124 -0
  47. package/dist/sgx-native-module/dcap-quote-verify.service.d.ts +54 -0
  48. package/dist/sgx-native-module/dcap-quote-verify.service.js +69 -0
  49. package/dist/sgx-native-module/dcap-quote-verify.service.spec.d.ts +1 -0
  50. package/dist/sgx-native-module/enclave.service.d.ts +82 -0
  51. package/dist/sgx-native-module/enclave.service.js +194 -0
  52. package/dist/sgx-native-module/errors.d.ts +9 -0
  53. package/dist/sgx-native-module/errors.js +25 -0
  54. package/dist/sgx-native-module/index.d.ts +5 -0
  55. package/dist/sgx-native-module/index.js +22 -0
  56. package/dist/sgx-native-module/pki.service.d.ts +11 -0
  57. package/dist/sgx-native-module/pki.service.js +31 -0
  58. package/package.json +76 -0
package/dist/index.js ADDED
@@ -0,0 +1,32 @@
1
+ "use strict";
2
+ var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
3
+ if (k2 === undefined) k2 = k;
4
+ var desc = Object.getOwnPropertyDescriptor(m, k);
5
+ if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
6
+ desc = { enumerable: true, get: function() { return m[k]; } };
7
+ }
8
+ Object.defineProperty(o, k2, desc);
9
+ }) : (function(o, m, k, k2) {
10
+ if (k2 === undefined) k2 = k;
11
+ o[k2] = m[k];
12
+ }));
13
+ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
14
+ Object.defineProperty(o, "default", { enumerable: true, value: v });
15
+ }) : function(o, v) {
16
+ o["default"] = v;
17
+ });
18
+ var __importStar = (this && this.__importStar) || function (mod) {
19
+ if (mod && mod.__esModule) return mod;
20
+ var result = {};
21
+ if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
22
+ __setModuleDefault(result, mod);
23
+ return result;
24
+ };
25
+ var __exportStar = (this && this.__exportStar) || function(m, exports) {
26
+ for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
27
+ };
28
+ Object.defineProperty(exports, "__esModule", { value: true });
29
+ exports.SgxNative = void 0;
30
+ exports.SgxNative = __importStar(require("./sgx-native-module"));
31
+ __exportStar(require("./quote-validator"), exports);
32
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxpRUFBaUQ7QUFDakQsb0RBQWtDIn0=
@@ -0,0 +1,3 @@
1
+ export declare const BASE_URL = "https://api.trustedservices.intel.com/sgx/certification/v3";
2
+ export declare const CRL_URL_EXTENSION_OID = "2.5.29.31";
3
+ export declare const FMSPC_EXTENSION_OID = "1.2.840.113741.1.13.1.4";
@@ -0,0 +1,7 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.FMSPC_EXTENSION_OID = exports.CRL_URL_EXTENSION_OID = exports.BASE_URL = void 0;
4
+ exports.BASE_URL = "https://api.trustedservices.intel.com/sgx/certification/v3";
5
+ exports.CRL_URL_EXTENSION_OID = "2.5.29.31";
6
+ exports.FMSPC_EXTENSION_OID = "1.2.840.113741.1.13.1.4";
7
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3F1b3RlLXZhbGlkYXRvci9jb25zdGFudHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQWEsUUFBQSxRQUFRLEdBQUcsNERBQTRELENBQUM7QUFDeEUsUUFBQSxxQkFBcUIsR0FBRyxXQUFXLENBQUM7QUFDcEMsUUFBQSxtQkFBbUIsR0FBRyx5QkFBeUIsQ0FBQyJ9
@@ -0,0 +1 @@
1
+ export { default as SGXUntrustedValidator } from "./sgx-untrasted-validator";
@@ -0,0 +1,9 @@
1
+ "use strict";
2
+ var __importDefault = (this && this.__importDefault) || function (mod) {
3
+ return (mod && mod.__esModule) ? mod : { "default": mod };
4
+ };
5
+ Object.defineProperty(exports, "__esModule", { value: true });
6
+ exports.SGXUntrustedValidator = void 0;
7
+ var sgx_untrasted_validator_1 = require("./sgx-untrasted-validator");
8
+ Object.defineProperty(exports, "SGXUntrustedValidator", { enumerable: true, get: function () { return __importDefault(sgx_untrasted_validator_1).default; } });
9
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcXVvdGUtdmFsaWRhdG9yL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLHFFQUE2RTtBQUFwRSxpSkFBQSxPQUFPLE9BQXlCIn0=
@@ -0,0 +1,12 @@
1
+ /// <reference types="node" />
2
+ declare class SGXUntrustedValidator {
3
+ private dqvc;
4
+ constructor();
5
+ validate(quote: Buffer): Promise<void>;
6
+ private fetchRootCrl;
7
+ private fetchIntermediateCrl;
8
+ private fetchTcbInfo;
9
+ private fetchQeIdentity;
10
+ private splitChain;
11
+ }
12
+ export default SGXUntrustedValidator;
@@ -0,0 +1,150 @@
1
+ "use strict";
2
+ var __importDefault = (this && this.__importDefault) || function (mod) {
3
+ return (mod && mod.__esModule) ? mod : { "default": mod };
4
+ };
5
+ Object.defineProperty(exports, "__esModule", { value: true });
6
+ const axios_1 = __importDefault(require("axios"));
7
+ const sgx_native_module_1 = require("../sgx-native-module");
8
+ const constants_1 = require("./constants");
9
+ // TODO: SP-323 check if possible to remove one of this libs
10
+ const x509_1 = require("@fidm/x509");
11
+ // @ts-ignore no types for this lib
12
+ const asn1_tree_1 = __importDefault(require("asn1-tree"));
13
+ class SGXUntrustedValidator {
14
+ constructor() {
15
+ this.dqvc = new sgx_native_module_1.DcapQuoteVerifyService();
16
+ }
17
+ async validate(quote) {
18
+ // Extract certs from quote
19
+ const quoteCerts = await this.dqvc.getQeCertificationData({ quote });
20
+ const [pckCert, intermediateCert, rootCert] = this.splitChain(quoteCerts.pemCertChain);
21
+ // Fetch CRLs and real root cert
22
+ const [rootCrl, { intermediateCrl, realRootCert }] = await Promise.all([
23
+ this.fetchRootCrl(rootCert),
24
+ this.fetchIntermediateCrl(),
25
+ ]);
26
+ // Compare root cert from quote with root cert from Intel
27
+ if (rootCert !== realRootCert)
28
+ throw new Error("Invalid root certificate");
29
+ // Validate pck cert
30
+ const expirationDate = Math.floor(Date.now() / 1000);
31
+ await this.dqvc.validatePckCertificate({
32
+ pemCertChain: pckCert + intermediateCert + rootCert,
33
+ pemIntermediateCaCrl: intermediateCrl,
34
+ pemRootCaCrl: rootCrl,
35
+ pemRootCaCertificate: rootCert,
36
+ expirationCheckDate: expirationDate,
37
+ });
38
+ // Fetch and validate TCB info and enclave identity
39
+ const [tcbInfo, qeIdentity] = await Promise.all([
40
+ this.fetchTcbInfo(pckCert, rootCert, rootCrl),
41
+ this.fetchQeIdentity(rootCert, rootCrl),
42
+ ]);
43
+ // Validate quote
44
+ await this.dqvc.validateQuote({
45
+ quote,
46
+ pemPckCertificate: pckCert,
47
+ pemIntermediateCrl: intermediateCrl,
48
+ tcbInfoJson: tcbInfo,
49
+ qeIdentityJson: qeIdentity,
50
+ });
51
+ }
52
+ async fetchRootCrl(rootCert) {
53
+ // Extract root CRL url form root cert
54
+ const rootCertParsed = x509_1.Certificate.fromPEM(Buffer.from(rootCert));
55
+ const rootCertExtension = rootCertParsed.extensions.find((item) => item.oid === constants_1.CRL_URL_EXTENSION_OID);
56
+ if (!rootCertExtension)
57
+ throw new Error("CRL url not found in root certificate");
58
+ let rootCrlUrl = Buffer.from(rootCertExtension.value).toString();
59
+ rootCrlUrl = rootCrlUrl.substring(rootCrlUrl.indexOf("http"), rootCrlUrl.length);
60
+ // Fetch root CRL
61
+ const rootCrlResult = await axios_1.default.get(rootCrlUrl, { responseType: "arraybuffer" });
62
+ let rootCrl = rootCrlResult.data;
63
+ // Convert to pem from der
64
+ rootCrl = `-----BEGIN X509 CRL-----\n${rootCrl
65
+ .toString("base64")
66
+ .match(/.{0,64}/g)
67
+ .join("\n")}-----END X509 CRL-----`;
68
+ return rootCrl;
69
+ }
70
+ async fetchIntermediateCrl() {
71
+ const intermediateCrlResult = await axios_1.default.get(`${constants_1.BASE_URL}/pckcrl?ca=platform&encoding=pem`);
72
+ // Get root cert from intel response
73
+ const mainChain = decodeURIComponent(intermediateCrlResult.headers["sgx-pck-crl-issuer-chain"]);
74
+ const [, realRootCert] = this.splitChain(mainChain);
75
+ return {
76
+ intermediateCrl: intermediateCrlResult.data,
77
+ realRootCert,
78
+ };
79
+ }
80
+ async fetchTcbInfo(pckCert, rootCert, rootCrl) {
81
+ // Extract FMSPC from pck cert
82
+ const pckCertParsed = x509_1.Certificate.fromPEM(Buffer.from(pckCert));
83
+ const fmspcExtensions = pckCertParsed.extensions
84
+ .map((item) => {
85
+ // Check top level oid part
86
+ if (constants_1.FMSPC_EXTENSION_OID.indexOf(item.oid) !== 0)
87
+ return null;
88
+ // Get deep oid part
89
+ const oidItemsLeft = constants_1.FMSPC_EXTENSION_OID.substring(item.oid.length, constants_1.FMSPC_EXTENSION_OID.length)
90
+ .split(".")
91
+ .filter((item) => item);
92
+ // Return value, if full oid found on top level
93
+ if (!oidItemsLeft.length)
94
+ return item.value;
95
+ // Decode deep tree structure
96
+ let fmspcTreeItem = asn1_tree_1.default.decode(item.value);
97
+ try {
98
+ // Find deep item in tree by oid part
99
+ oidItemsLeft.forEach((key) => (fmspcTreeItem = fmspcTreeItem.elements[+key - 1]));
100
+ // Return value (second sub item, oid first sub item) of deep item
101
+ return fmspcTreeItem.elements[1].value;
102
+ }
103
+ catch (e) {
104
+ return null;
105
+ }
106
+ })
107
+ .filter((item) => item);
108
+ if (!fmspcExtensions.length)
109
+ throw new Error("FMSPC not found in pck certificate");
110
+ const FMSPC = Buffer.from(fmspcExtensions[0]).toString("hex");
111
+ // Fetch TCB info and issuer chain
112
+ const tcbInfoResult = await axios_1.default.get(`${constants_1.BASE_URL}/tcb?fmspc=${FMSPC}`);
113
+ const tcbInfo = JSON.stringify(tcbInfoResult.data);
114
+ const tcbInfoChain = decodeURIComponent(tcbInfoResult.headers["sgx-tcb-info-issuer-chain"]);
115
+ // Validate TCB info
116
+ const expirationDate = Math.floor(Date.now() / 1000);
117
+ await this.dqvc.validateTcbInfo({
118
+ tcbInfoJson: tcbInfo,
119
+ pemCertChain: tcbInfoChain,
120
+ pemRootCaCrl: rootCrl,
121
+ pemRootCaCertificate: rootCert,
122
+ expirationCheckDate: expirationDate,
123
+ });
124
+ return tcbInfo;
125
+ }
126
+ async fetchQeIdentity(rootCert, rootCrl) {
127
+ // Fetch enclave identity and issuer chain
128
+ const qeIdentityResult = await axios_1.default.get(`${constants_1.BASE_URL}/qe/identity`);
129
+ const qeIdentity = JSON.stringify(qeIdentityResult.data);
130
+ const qeIdentityChain = decodeURIComponent(qeIdentityResult.headers["sgx-enclave-identity-issuer-chain"]);
131
+ // Validate enclave identity
132
+ const expirationDate = Math.floor(Date.now() / 1000);
133
+ await this.dqvc.validateEnclaveIdentity({
134
+ enclaveIdentityJson: qeIdentity,
135
+ pemCertChain: qeIdentityChain,
136
+ pemRootCaCrl: rootCrl,
137
+ pemRootCaCertificate: rootCert,
138
+ expirationCheckDate: expirationDate,
139
+ });
140
+ return qeIdentity;
141
+ }
142
+ splitChain(chain) {
143
+ return chain
144
+ .split("-----BEGIN CERTIFICATE-----")
145
+ .filter((cert) => cert)
146
+ .map((cert) => `-----BEGIN CERTIFICATE-----` + cert);
147
+ }
148
+ }
149
+ exports.default = SGXUntrustedValidator;
150
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2d4LXVudHJhc3RlZC12YWxpZGF0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcXVvdGUtdmFsaWRhdG9yL3NneC11bnRyYXN0ZWQtdmFsaWRhdG9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsa0RBQTBCO0FBQzFCLDREQUE4RDtBQUM5RCwyQ0FBbUY7QUFFbkYsNERBQTREO0FBQzVELHFDQUF5QztBQUN6QyxtQ0FBbUM7QUFDbkMsMERBQWlDO0FBRWpDLE1BQU0scUJBQXFCO0lBR3ZCO1FBQ0ksSUFBSSxDQUFDLElBQUksR0FBRyxJQUFJLDBDQUFzQixFQUFFLENBQUM7SUFDN0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsS0FBYTtRQUMvQiwyQkFBMkI7UUFDM0IsTUFBTSxVQUFVLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLHNCQUFzQixDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNyRSxNQUFNLENBQUMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLFFBQVEsQ0FBQyxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLFlBQWEsQ0FBQyxDQUFDO1FBRXhGLGdDQUFnQztRQUNoQyxNQUFNLENBQUMsT0FBTyxFQUFFLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDO1lBQ25FLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDO1lBQzNCLElBQUksQ0FBQyxvQkFBb0IsRUFBRTtTQUM5QixDQUFDLENBQUM7UUFFSCx5REFBeUQ7UUFDekQsSUFBSSxRQUFRLEtBQUssWUFBWTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUUzRSxvQkFBb0I7UUFDcEIsTUFBTSxjQUFjLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7UUFDckQsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLHNCQUFzQixDQUFDO1lBQ25DLFlBQVksRUFBRSxPQUFPLEdBQUcsZ0JBQWdCLEdBQUcsUUFBUTtZQUNuRCxvQkFBb0IsRUFBRSxlQUFlO1lBQ3JDLFlBQVksRUFBRSxPQUFPO1lBQ3JCLG9CQUFvQixFQUFFLFFBQVE7WUFDOUIsbUJBQW1CLEVBQUUsY0FBYztTQUN0QyxDQUFDLENBQUM7UUFFSCxtREFBbUQ7UUFDbkQsTUFBTSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7WUFDNUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQztZQUM3QyxJQUFJLENBQUMsZUFBZSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUM7U0FDMUMsQ0FBQyxDQUFDO1FBRUgsaUJBQWlCO1FBQ2pCLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUM7WUFDMUIsS0FBSztZQUNMLGlCQUFpQixFQUFFLE9BQU87WUFDMUIsa0JBQWtCLEVBQUUsZUFBZTtZQUNuQyxXQUFXLEVBQUUsT0FBTztZQUNwQixjQUFjLEVBQUUsVUFBVTtTQUM3QixDQUFDLENBQUM7SUFDUCxDQUFDO0lBRU8sS0FBSyxDQUFDLFlBQVksQ0FBQyxRQUFnQjtRQUN2QyxzQ0FBc0M7UUFDdEMsTUFBTSxjQUFjLEdBQUcsa0JBQVcsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQ2xFLE1BQU0saUJBQWlCLEdBQUcsY0FBYyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFTLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssaUNBQXFCLENBQUMsQ0FBQztRQUM1RyxJQUFJLENBQUMsaUJBQWlCO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQ2pGLElBQUksVUFBVSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsaUJBQWtCLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDbEUsVUFBVSxHQUFHLFVBQVUsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFakYsaUJBQWlCO1FBQ2pCLE1BQU0sYUFBYSxHQUFHLE1BQU0sZUFBSyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsRUFBRSxZQUFZLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUNuRixJQUFJLE9BQU8sR0FBRyxhQUFhLENBQUMsSUFBSSxDQUFDO1FBRWpDLDBCQUEwQjtRQUMxQixPQUFPLEdBQUcsNkJBQTZCLE9BQU87YUFDekMsUUFBUSxDQUFDLFFBQVEsQ0FBQzthQUNsQixLQUFLLENBQUMsVUFBVSxDQUFFO2FBQ2xCLElBQUksQ0FBQyxJQUFJLENBQUMsd0JBQXdCLENBQUM7UUFFeEMsT0FBTyxPQUFPLENBQUM7SUFDbkIsQ0FBQztJQUVPLEtBQUssQ0FBQyxvQkFBb0I7UUFDOUIsTUFBTSxxQkFBcUIsR0FBRyxNQUFNLGVBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxvQkFBUSxrQ0FBa0MsQ0FBQyxDQUFDO1FBRTdGLG9DQUFvQztRQUNwQyxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsMEJBQTBCLENBQUMsQ0FBQyxDQUFDO1FBQ2hHLE1BQU0sQ0FBQyxFQUFFLFlBQVksQ0FBQyxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7UUFFcEQsT0FBTztZQUNILGVBQWUsRUFBRSxxQkFBcUIsQ0FBQyxJQUFJO1lBQzNDLFlBQVk7U0FDZixDQUFDO0lBQ04sQ0FBQztJQUVPLEtBQUssQ0FBQyxZQUFZLENBQUMsT0FBZSxFQUFFLFFBQWdCLEVBQUUsT0FBZTtRQUN6RSw4QkFBOEI7UUFDOUIsTUFBTSxhQUFhLEdBQUcsa0JBQVcsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLE1BQU0sZUFBZSxHQUFHLGFBQWEsQ0FBQyxVQUFVO2FBQzNDLEdBQUcsQ0FBQyxDQUFDLElBQVMsRUFBRSxFQUFFO1lBQ2YsMkJBQTJCO1lBQzNCLElBQUksK0JBQW1CLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDO2dCQUFFLE9BQU8sSUFBSSxDQUFDO1lBRTdELG9CQUFvQjtZQUNwQixNQUFNLFlBQVksR0FBRywrQkFBbUIsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsK0JBQW1CLENBQUMsTUFBTSxDQUFDO2lCQUMxRixLQUFLLENBQUMsR0FBRyxDQUFDO2lCQUNWLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFNUIsK0NBQStDO1lBQy9DLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTTtnQkFBRSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUM7WUFFNUMsNkJBQTZCO1lBQzdCLElBQUksYUFBYSxHQUFHLG1CQUFRLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNoRCxJQUFJO2dCQUNBLHFDQUFxQztnQkFDckMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxhQUFhLEdBQUcsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ2xGLGtFQUFrRTtnQkFDbEUsT0FBTyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQzthQUMxQztZQUFDLE9BQU8sQ0FBQyxFQUFFO2dCQUNSLE9BQU8sSUFBSSxDQUFDO2FBQ2Y7UUFDTCxDQUFDLENBQUM7YUFDRCxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzVCLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUNuRixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUU5RCxrQ0FBa0M7UUFDbEMsTUFBTSxhQUFhLEdBQUcsTUFBTSxlQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsb0JBQVEsY0FBYyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ25ELE1BQU0sWUFBWSxHQUFHLGtCQUFrQixDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsMkJBQTJCLENBQUMsQ0FBQyxDQUFDO1FBRTVGLG9CQUFvQjtRQUNwQixNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztRQUNyRCxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDO1lBQzVCLFdBQVcsRUFBRSxPQUFPO1lBQ3BCLFlBQVksRUFBRSxZQUFZO1lBQzFCLFlBQVksRUFBRSxPQUFPO1lBQ3JCLG9CQUFvQixFQUFFLFFBQVE7WUFDOUIsbUJBQW1CLEVBQUUsY0FBYztTQUN0QyxDQUFDLENBQUM7UUFFSCxPQUFPLE9BQU8sQ0FBQztJQUNuQixDQUFDO0lBRU8sS0FBSyxDQUFDLGVBQWUsQ0FBQyxRQUFnQixFQUFFLE9BQWU7UUFDM0QsMENBQTBDO1FBQzFDLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxlQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsb0JBQVEsY0FBYyxDQUFDLENBQUM7UUFDcEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN6RCxNQUFNLGVBQWUsR0FBRyxrQkFBa0IsQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsbUNBQW1DLENBQUMsQ0FBQyxDQUFDO1FBRTFHLDRCQUE0QjtRQUM1QixNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztRQUNyRCxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsdUJBQXVCLENBQUM7WUFDcEMsbUJBQW1CLEVBQUUsVUFBVTtZQUMvQixZQUFZLEVBQUUsZUFBZTtZQUM3QixZQUFZLEVBQUUsT0FBTztZQUNyQixvQkFBb0IsRUFBRSxRQUFRO1lBQzlCLG1CQUFtQixFQUFFLGNBQWM7U0FDdEMsQ0FBQyxDQUFDO1FBRUgsT0FBTyxVQUFVLENBQUM7SUFDdEIsQ0FBQztJQUVPLFVBQVUsQ0FBQyxLQUFhO1FBQzVCLE9BQU8sS0FBSzthQUNQLEtBQUssQ0FBQyw2QkFBNkIsQ0FBQzthQUNwQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQzthQUN0QixHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLDZCQUE2QixHQUFHLElBQUksQ0FBQyxDQUFDO0lBQzdELENBQUM7Q0FDSjtBQUVELGtCQUFlLHFCQUFxQixDQUFDIn0=
@@ -0,0 +1,105 @@
1
+ export declare enum KeyType {
2
+ SGX_KEYSELECT_EINITTOKEN = 0,
3
+ SGX_KEYSELECT_PROVISION = 1,
4
+ SGX_KEYSELECT_PROVISION_SEAL = 2,
5
+ SGX_KEYSELECT_REPORT = 3,
6
+ SGX_KEYSELECT_SEAL = 4
7
+ }
8
+ export declare enum KeyPolicy {
9
+ SGX_KEYPOLICY_MRENCLAVE = 1,
10
+ SGX_KEYPOLICY_MRSIGNER = 2,
11
+ SGX_KEYPOLICY_NOISVPRODID = 4,
12
+ SGX_KEYPOLICY_CONFIGID = 8,
13
+ SGX_KEYPOLICY_ISVFAMILYID = 16,
14
+ SGX_KEYPOLICY_ISVEXTPRODID = 32
15
+ }
16
+ export declare enum DcapQuoteVerificationStatus {
17
+ OK = 0,
18
+ UNSUPPORTED_CERT_FORMAT = 1,
19
+ SGX_ROOT_CA_MISSING = 2,
20
+ SGX_ROOT_CA_INVALID = 3,
21
+ SGX_ROOT_CA_INVALID_EXTENSIONS = 4,
22
+ SGX_ROOT_CA_INVALID_ISSUER = 5,
23
+ SGX_ROOT_CA_UNTRUSTED = 6,
24
+ SGX_INTERMEDIATE_CA_MISSING = 7,
25
+ SGX_INTERMEDIATE_CA_INVALID = 8,
26
+ SGX_INTERMEDIATE_CA_INVALID_EXTENSIONS = 9,
27
+ SGX_INTERMEDIATE_CA_INVALID_ISSUER = 10,
28
+ SGX_INTERMEDIATE_CA_REVOKED = 11,
29
+ SGX_PCK_MISSING = 12,
30
+ SGX_PCK_INVALID = 13,
31
+ SGX_PCK_INVALID_EXTENSIONS = 14,
32
+ SGX_PCK_INVALID_ISSUER = 15,
33
+ SGX_PCK_REVOKED = 16,
34
+ TRUSTED_ROOT_CA_INVALID = 17,
35
+ SGX_PCK_CERT_CHAIN_UNTRUSTED = 18,
36
+ SGX_TCB_INFO_UNSUPPORTED_FORMAT = 19,
37
+ SGX_TCB_INFO_INVALID = 20,
38
+ TCB_INFO_INVALID_SIGNATURE = 21,
39
+ SGX_TCB_SIGNING_CERT_MISSING = 22,
40
+ SGX_TCB_SIGNING_CERT_INVALID = 23,
41
+ SGX_TCB_SIGNING_CERT_INVALID_EXTENSIONS = 24,
42
+ SGX_TCB_SIGNING_CERT_INVALID_ISSUER = 25,
43
+ SGX_TCB_SIGNING_CERT_CHAIN_UNTRUSTED = 26,
44
+ SGX_TCB_SIGNING_CERT_REVOKED = 27,
45
+ SGX_CRL_UNSUPPORTED_FORMAT = 28,
46
+ SGX_CRL_UNKNOWN_ISSUER = 29,
47
+ SGX_CRL_INVALID = 30,
48
+ SGX_CRL_INVALID_EXTENSIONS = 31,
49
+ SGX_CRL_INVALID_SIGNATURE = 32,
50
+ SGX_CA_CERT_UNSUPPORTED_FORMAT = 33,
51
+ SGX_CA_CERT_INVALID = 34,
52
+ TRUSTED_ROOT_CA_UNSUPPORTED_FORMAT = 35,
53
+ MISSING_PARAMETERS = 36,
54
+ UNSUPPORTED_QUOTE_FORMAT = 37,
55
+ UNSUPPORTED_PCK_CERT_FORMAT = 38,
56
+ INVALID_PCK_CERT = 39,
57
+ UNSUPPORTED_PCK_RL_FORMAT = 40,
58
+ INVALID_PCK_CRL = 41,
59
+ UNSUPPORTED_TCB_INFO_FORMAT = 42,
60
+ PCK_REVOKED = 43,
61
+ TCB_INFO_MISMATCH = 44,
62
+ TCB_OUT_OF_DATE = 45,
63
+ TCB_REVOKED = 46,
64
+ TCB_CONFIGURATION_NEEDED = 47,
65
+ TCB_OUT_OF_DATE_CONFIGURATION_NEEDED = 48,
66
+ TCB_NOT_SUPPORTED = 49,
67
+ TCB_UNRECOGNIZED_STATUS = 50,
68
+ UNSUPPORTED_QE_CERTIFICATION = 51,
69
+ INVALID_QE_CERTIFICATION_DATA_SIZE = 52,
70
+ UNSUPPORTED_QE_CERTIFICATION_DATA_TYPE = 53,
71
+ PCK_CERT_MISMATCH = 54,
72
+ INVALID_QE_REPORT_SIGNATURE = 55,
73
+ INVALID_QE_REPORT_DATA = 56,
74
+ INVALID_QUOTE_SIGNATURE = 57,
75
+ SGX_QE_IDENTITY_UNSUPPORTED_FORMAT = 58,
76
+ SGX_QE_IDENTITY_INVALID = 59,
77
+ SGX_QE_IDENTITY_INVALID_SIGNATURE = 60,
78
+ SGX_ENCLAVE_REPORT_UNSUPPORTED_FORMAT = 61,
79
+ SGX_ENCLAVE_IDENTITY_UNSUPPORTED_FORMAT = 62,
80
+ SGX_ENCLAVE_IDENTITY_INVALID = 63,
81
+ SGX_ENCLAVE_IDENTITY_UNSUPPORTED_VERSION = 64,
82
+ SGX_ENCLAVE_IDENTITY_OUT_OF_DATE = 65,
83
+ SGX_ENCLAVE_REPORT_MISCSELECT_MISMATCH = 66,
84
+ SGX_ENCLAVE_REPORT_ATTRIBUTES_MISMATCH = 67,
85
+ SGX_ENCLAVE_REPORT_MRENCLAVE_MISMATCH = 68,
86
+ SGX_ENCLAVE_REPORT_MRSIGNER_MISMATCH = 69,
87
+ SGX_ENCLAVE_REPORT_ISVPRODID_MISMATCH = 70,
88
+ SGX_ENCLAVE_REPORT_ISVSVN_OUT_OF_DATE = 71,
89
+ UNSUPPORTED_QE_IDENTITY_FORMAT = 72,
90
+ QE_IDENTITY_OUT_OF_DATE = 73,
91
+ QE_IDENTITY_MISMATCH = 74,
92
+ SGX_TCB_INFO_EXPIRED = 75,
93
+ SGX_ENCLAVE_IDENTITY_INVALID_SIGNATURE = 76,
94
+ INVALID_PARAMETER = 77,
95
+ SGX_PCK_CERT_CHAIN_EXPIRED = 78,
96
+ SGX_CRL_EXPIRED = 79,
97
+ SGX_SIGNING_CERT_CHAIN_EXPIRED = 80,
98
+ SGX_ENCLAVE_IDENTITY_EXPIRED = 81,
99
+ TCB_SW_HARDENING_NEEDED = 82,
100
+ TCB_CONFIGURATION_AND_SW_HARDENING_NEEDED = 83,
101
+ SGX_ENCLAVE_REPORT_ISVSVN_REVOKED = 84
102
+ }
103
+ export declare const DcapQuoteVerificationStatusMap: {
104
+ [key: string]: string;
105
+ };
@@ -0,0 +1,124 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.DcapQuoteVerificationStatusMap = exports.DcapQuoteVerificationStatus = exports.KeyPolicy = exports.KeyType = void 0;
4
+ var KeyType;
5
+ (function (KeyType) {
6
+ // Launch key
7
+ KeyType[KeyType["SGX_KEYSELECT_EINITTOKEN"] = 0] = "SGX_KEYSELECT_EINITTOKEN";
8
+ // Provisioning key
9
+ KeyType[KeyType["SGX_KEYSELECT_PROVISION"] = 1] = "SGX_KEYSELECT_PROVISION";
10
+ // Provisioning seal key
11
+ KeyType[KeyType["SGX_KEYSELECT_PROVISION_SEAL"] = 2] = "SGX_KEYSELECT_PROVISION_SEAL";
12
+ // Report key
13
+ KeyType[KeyType["SGX_KEYSELECT_REPORT"] = 3] = "SGX_KEYSELECT_REPORT";
14
+ // Seal key
15
+ KeyType[KeyType["SGX_KEYSELECT_SEAL"] = 4] = "SGX_KEYSELECT_SEAL";
16
+ })(KeyType = exports.KeyType || (exports.KeyType = {}));
17
+ var KeyPolicy;
18
+ (function (KeyPolicy) {
19
+ // Derive key using the enclave’s ENCLAVE measurement register
20
+ KeyPolicy[KeyPolicy["SGX_KEYPOLICY_MRENCLAVE"] = 1] = "SGX_KEYPOLICY_MRENCLAVE";
21
+ // Derive key using the enclave’s SIGNER measurement register
22
+ KeyPolicy[KeyPolicy["SGX_KEYPOLICY_MRSIGNER"] = 2] = "SGX_KEYPOLICY_MRSIGNER";
23
+ // Derive key without the enclave's ISVPRODID
24
+ KeyPolicy[KeyPolicy["SGX_KEYPOLICY_NOISVPRODID"] = 4] = "SGX_KEYPOLICY_NOISVPRODID";
25
+ // Derive key with the enclave's CONFIGID
26
+ KeyPolicy[KeyPolicy["SGX_KEYPOLICY_CONFIGID"] = 8] = "SGX_KEYPOLICY_CONFIGID";
27
+ // Derive key with the enclave's ISVFAMILYID
28
+ KeyPolicy[KeyPolicy["SGX_KEYPOLICY_ISVFAMILYID"] = 16] = "SGX_KEYPOLICY_ISVFAMILYID";
29
+ // Derive key with the enclave's ISVEXTPRODID
30
+ KeyPolicy[KeyPolicy["SGX_KEYPOLICY_ISVEXTPRODID"] = 32] = "SGX_KEYPOLICY_ISVEXTPRODID";
31
+ })(KeyPolicy = exports.KeyPolicy || (exports.KeyPolicy = {}));
32
+ var DcapQuoteVerificationStatus;
33
+ (function (DcapQuoteVerificationStatus) {
34
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["OK"] = 0] = "OK";
35
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["UNSUPPORTED_CERT_FORMAT"] = 1] = "UNSUPPORTED_CERT_FORMAT";
36
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ROOT_CA_MISSING"] = 2] = "SGX_ROOT_CA_MISSING";
37
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ROOT_CA_INVALID"] = 3] = "SGX_ROOT_CA_INVALID";
38
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ROOT_CA_INVALID_EXTENSIONS"] = 4] = "SGX_ROOT_CA_INVALID_EXTENSIONS";
39
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ROOT_CA_INVALID_ISSUER"] = 5] = "SGX_ROOT_CA_INVALID_ISSUER";
40
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ROOT_CA_UNTRUSTED"] = 6] = "SGX_ROOT_CA_UNTRUSTED";
41
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_INTERMEDIATE_CA_MISSING"] = 7] = "SGX_INTERMEDIATE_CA_MISSING";
42
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_INTERMEDIATE_CA_INVALID"] = 8] = "SGX_INTERMEDIATE_CA_INVALID";
43
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_INTERMEDIATE_CA_INVALID_EXTENSIONS"] = 9] = "SGX_INTERMEDIATE_CA_INVALID_EXTENSIONS";
44
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_INTERMEDIATE_CA_INVALID_ISSUER"] = 10] = "SGX_INTERMEDIATE_CA_INVALID_ISSUER";
45
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_INTERMEDIATE_CA_REVOKED"] = 11] = "SGX_INTERMEDIATE_CA_REVOKED";
46
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_PCK_MISSING"] = 12] = "SGX_PCK_MISSING";
47
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_PCK_INVALID"] = 13] = "SGX_PCK_INVALID";
48
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_PCK_INVALID_EXTENSIONS"] = 14] = "SGX_PCK_INVALID_EXTENSIONS";
49
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_PCK_INVALID_ISSUER"] = 15] = "SGX_PCK_INVALID_ISSUER";
50
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_PCK_REVOKED"] = 16] = "SGX_PCK_REVOKED";
51
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TRUSTED_ROOT_CA_INVALID"] = 17] = "TRUSTED_ROOT_CA_INVALID";
52
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_PCK_CERT_CHAIN_UNTRUSTED"] = 18] = "SGX_PCK_CERT_CHAIN_UNTRUSTED";
53
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_INFO_UNSUPPORTED_FORMAT"] = 19] = "SGX_TCB_INFO_UNSUPPORTED_FORMAT";
54
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_INFO_INVALID"] = 20] = "SGX_TCB_INFO_INVALID";
55
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_INFO_INVALID_SIGNATURE"] = 21] = "TCB_INFO_INVALID_SIGNATURE";
56
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_SIGNING_CERT_MISSING"] = 22] = "SGX_TCB_SIGNING_CERT_MISSING";
57
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_SIGNING_CERT_INVALID"] = 23] = "SGX_TCB_SIGNING_CERT_INVALID";
58
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_SIGNING_CERT_INVALID_EXTENSIONS"] = 24] = "SGX_TCB_SIGNING_CERT_INVALID_EXTENSIONS";
59
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_SIGNING_CERT_INVALID_ISSUER"] = 25] = "SGX_TCB_SIGNING_CERT_INVALID_ISSUER";
60
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_SIGNING_CERT_CHAIN_UNTRUSTED"] = 26] = "SGX_TCB_SIGNING_CERT_CHAIN_UNTRUSTED";
61
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_SIGNING_CERT_REVOKED"] = 27] = "SGX_TCB_SIGNING_CERT_REVOKED";
62
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_CRL_UNSUPPORTED_FORMAT"] = 28] = "SGX_CRL_UNSUPPORTED_FORMAT";
63
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_CRL_UNKNOWN_ISSUER"] = 29] = "SGX_CRL_UNKNOWN_ISSUER";
64
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_CRL_INVALID"] = 30] = "SGX_CRL_INVALID";
65
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_CRL_INVALID_EXTENSIONS"] = 31] = "SGX_CRL_INVALID_EXTENSIONS";
66
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_CRL_INVALID_SIGNATURE"] = 32] = "SGX_CRL_INVALID_SIGNATURE";
67
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_CA_CERT_UNSUPPORTED_FORMAT"] = 33] = "SGX_CA_CERT_UNSUPPORTED_FORMAT";
68
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_CA_CERT_INVALID"] = 34] = "SGX_CA_CERT_INVALID";
69
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TRUSTED_ROOT_CA_UNSUPPORTED_FORMAT"] = 35] = "TRUSTED_ROOT_CA_UNSUPPORTED_FORMAT";
70
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["MISSING_PARAMETERS"] = 36] = "MISSING_PARAMETERS";
71
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["UNSUPPORTED_QUOTE_FORMAT"] = 37] = "UNSUPPORTED_QUOTE_FORMAT";
72
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["UNSUPPORTED_PCK_CERT_FORMAT"] = 38] = "UNSUPPORTED_PCK_CERT_FORMAT";
73
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["INVALID_PCK_CERT"] = 39] = "INVALID_PCK_CERT";
74
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["UNSUPPORTED_PCK_RL_FORMAT"] = 40] = "UNSUPPORTED_PCK_RL_FORMAT";
75
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["INVALID_PCK_CRL"] = 41] = "INVALID_PCK_CRL";
76
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["UNSUPPORTED_TCB_INFO_FORMAT"] = 42] = "UNSUPPORTED_TCB_INFO_FORMAT";
77
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["PCK_REVOKED"] = 43] = "PCK_REVOKED";
78
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_INFO_MISMATCH"] = 44] = "TCB_INFO_MISMATCH";
79
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_OUT_OF_DATE"] = 45] = "TCB_OUT_OF_DATE";
80
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_REVOKED"] = 46] = "TCB_REVOKED";
81
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_CONFIGURATION_NEEDED"] = 47] = "TCB_CONFIGURATION_NEEDED";
82
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_OUT_OF_DATE_CONFIGURATION_NEEDED"] = 48] = "TCB_OUT_OF_DATE_CONFIGURATION_NEEDED";
83
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_NOT_SUPPORTED"] = 49] = "TCB_NOT_SUPPORTED";
84
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_UNRECOGNIZED_STATUS"] = 50] = "TCB_UNRECOGNIZED_STATUS";
85
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["UNSUPPORTED_QE_CERTIFICATION"] = 51] = "UNSUPPORTED_QE_CERTIFICATION";
86
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["INVALID_QE_CERTIFICATION_DATA_SIZE"] = 52] = "INVALID_QE_CERTIFICATION_DATA_SIZE";
87
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["UNSUPPORTED_QE_CERTIFICATION_DATA_TYPE"] = 53] = "UNSUPPORTED_QE_CERTIFICATION_DATA_TYPE";
88
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["PCK_CERT_MISMATCH"] = 54] = "PCK_CERT_MISMATCH";
89
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["INVALID_QE_REPORT_SIGNATURE"] = 55] = "INVALID_QE_REPORT_SIGNATURE";
90
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["INVALID_QE_REPORT_DATA"] = 56] = "INVALID_QE_REPORT_DATA";
91
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["INVALID_QUOTE_SIGNATURE"] = 57] = "INVALID_QUOTE_SIGNATURE";
92
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_QE_IDENTITY_UNSUPPORTED_FORMAT"] = 58] = "SGX_QE_IDENTITY_UNSUPPORTED_FORMAT";
93
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_QE_IDENTITY_INVALID"] = 59] = "SGX_QE_IDENTITY_INVALID";
94
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_QE_IDENTITY_INVALID_SIGNATURE"] = 60] = "SGX_QE_IDENTITY_INVALID_SIGNATURE";
95
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_REPORT_UNSUPPORTED_FORMAT"] = 61] = "SGX_ENCLAVE_REPORT_UNSUPPORTED_FORMAT";
96
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_IDENTITY_UNSUPPORTED_FORMAT"] = 62] = "SGX_ENCLAVE_IDENTITY_UNSUPPORTED_FORMAT";
97
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_IDENTITY_INVALID"] = 63] = "SGX_ENCLAVE_IDENTITY_INVALID";
98
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_IDENTITY_UNSUPPORTED_VERSION"] = 64] = "SGX_ENCLAVE_IDENTITY_UNSUPPORTED_VERSION";
99
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_IDENTITY_OUT_OF_DATE"] = 65] = "SGX_ENCLAVE_IDENTITY_OUT_OF_DATE";
100
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_REPORT_MISCSELECT_MISMATCH"] = 66] = "SGX_ENCLAVE_REPORT_MISCSELECT_MISMATCH";
101
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_REPORT_ATTRIBUTES_MISMATCH"] = 67] = "SGX_ENCLAVE_REPORT_ATTRIBUTES_MISMATCH";
102
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_REPORT_MRENCLAVE_MISMATCH"] = 68] = "SGX_ENCLAVE_REPORT_MRENCLAVE_MISMATCH";
103
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_REPORT_MRSIGNER_MISMATCH"] = 69] = "SGX_ENCLAVE_REPORT_MRSIGNER_MISMATCH";
104
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_REPORT_ISVPRODID_MISMATCH"] = 70] = "SGX_ENCLAVE_REPORT_ISVPRODID_MISMATCH";
105
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_REPORT_ISVSVN_OUT_OF_DATE"] = 71] = "SGX_ENCLAVE_REPORT_ISVSVN_OUT_OF_DATE";
106
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["UNSUPPORTED_QE_IDENTITY_FORMAT"] = 72] = "UNSUPPORTED_QE_IDENTITY_FORMAT";
107
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["QE_IDENTITY_OUT_OF_DATE"] = 73] = "QE_IDENTITY_OUT_OF_DATE";
108
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["QE_IDENTITY_MISMATCH"] = 74] = "QE_IDENTITY_MISMATCH";
109
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_TCB_INFO_EXPIRED"] = 75] = "SGX_TCB_INFO_EXPIRED";
110
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_IDENTITY_INVALID_SIGNATURE"] = 76] = "SGX_ENCLAVE_IDENTITY_INVALID_SIGNATURE";
111
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["INVALID_PARAMETER"] = 77] = "INVALID_PARAMETER";
112
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_PCK_CERT_CHAIN_EXPIRED"] = 78] = "SGX_PCK_CERT_CHAIN_EXPIRED";
113
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_CRL_EXPIRED"] = 79] = "SGX_CRL_EXPIRED";
114
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_SIGNING_CERT_CHAIN_EXPIRED"] = 80] = "SGX_SIGNING_CERT_CHAIN_EXPIRED";
115
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_IDENTITY_EXPIRED"] = 81] = "SGX_ENCLAVE_IDENTITY_EXPIRED";
116
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_SW_HARDENING_NEEDED"] = 82] = "TCB_SW_HARDENING_NEEDED";
117
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["TCB_CONFIGURATION_AND_SW_HARDENING_NEEDED"] = 83] = "TCB_CONFIGURATION_AND_SW_HARDENING_NEEDED";
118
+ DcapQuoteVerificationStatus[DcapQuoteVerificationStatus["SGX_ENCLAVE_REPORT_ISVSVN_REVOKED"] = 84] = "SGX_ENCLAVE_REPORT_ISVSVN_REVOKED";
119
+ })(DcapQuoteVerificationStatus = exports.DcapQuoteVerificationStatus || (exports.DcapQuoteVerificationStatus = {}));
120
+ exports.DcapQuoteVerificationStatusMap = Object.entries(DcapQuoteVerificationStatus).reduce((obj, [value, key]) => {
121
+ obj[key] = value;
122
+ return obj;
123
+ }, {});
124
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NneC1uYXRpdmUtbW9kdWxlL2NvbnN0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxJQUFZLE9BZVg7QUFmRCxXQUFZLE9BQU87SUFDZixhQUFhO0lBQ2IsNkVBQWlDLENBQUE7SUFFakMsbUJBQW1CO0lBQ25CLDJFQUFnQyxDQUFBO0lBRWhDLHdCQUF3QjtJQUN4QixxRkFBcUMsQ0FBQTtJQUVyQyxhQUFhO0lBQ2IscUVBQTZCLENBQUE7SUFFN0IsV0FBVztJQUNYLGlFQUEyQixDQUFBO0FBQy9CLENBQUMsRUFmVyxPQUFPLEdBQVAsZUFBTyxLQUFQLGVBQU8sUUFlbEI7QUFFRCxJQUFZLFNBa0JYO0FBbEJELFdBQVksU0FBUztJQUNqQiw4REFBOEQ7SUFDOUQsK0VBQWdDLENBQUE7SUFFaEMsNkRBQTZEO0lBQzdELDZFQUErQixDQUFBO0lBRS9CLDZDQUE2QztJQUM3QyxtRkFBa0MsQ0FBQTtJQUVsQyx5Q0FBeUM7SUFDekMsNkVBQStCLENBQUE7SUFFL0IsNENBQTRDO0lBQzVDLG9GQUFrQyxDQUFBO0lBRWxDLDZDQUE2QztJQUM3QyxzRkFBbUMsQ0FBQTtBQUN2QyxDQUFDLEVBbEJXLFNBQVMsR0FBVCxpQkFBUyxLQUFULGlCQUFTLFFBa0JwQjtBQUVELElBQVksMkJBb0dYO0FBcEdELFdBQVksMkJBQTJCO0lBQ25DLHlFQUFNLENBQUE7SUFFTixtSEFBdUIsQ0FBQTtJQUV2QiwyR0FBbUIsQ0FBQTtJQUNuQiwyR0FBbUIsQ0FBQTtJQUNuQixpSUFBOEIsQ0FBQTtJQUM5Qix5SEFBMEIsQ0FBQTtJQUMxQiwrR0FBcUIsQ0FBQTtJQUVyQiwySEFBMkIsQ0FBQTtJQUMzQiwySEFBMkIsQ0FBQTtJQUMzQixpSkFBc0MsQ0FBQTtJQUN0QywwSUFBa0MsQ0FBQTtJQUNsQyw0SEFBMkIsQ0FBQTtJQUUzQixvR0FBZSxDQUFBO0lBQ2Ysb0dBQWUsQ0FBQTtJQUNmLDBIQUEwQixDQUFBO0lBQzFCLGtIQUFzQixDQUFBO0lBQ3RCLG9HQUFlLENBQUE7SUFFZixvSEFBdUIsQ0FBQTtJQUN2Qiw4SEFBNEIsQ0FBQTtJQUU1QixvSUFBK0IsQ0FBQTtJQUMvQiw4R0FBb0IsQ0FBQTtJQUNwQiwwSEFBMEIsQ0FBQTtJQUUxQiw4SEFBNEIsQ0FBQTtJQUM1Qiw4SEFBNEIsQ0FBQTtJQUM1QixvSkFBdUMsQ0FBQTtJQUN2Qyw0SUFBbUMsQ0FBQTtJQUNuQyw4SUFBb0MsQ0FBQTtJQUNwQyw4SEFBNEIsQ0FBQTtJQUU1QiwwSEFBMEIsQ0FBQTtJQUMxQixrSEFBc0IsQ0FBQTtJQUN0QixvR0FBZSxDQUFBO0lBQ2YsMEhBQTBCLENBQUE7SUFDMUIsd0hBQXlCLENBQUE7SUFFekIsa0lBQThCLENBQUE7SUFDOUIsNEdBQW1CLENBQUE7SUFDbkIsMElBQWtDLENBQUE7SUFFbEMsMEdBQWtCLENBQUE7SUFFbEIsc0hBQXdCLENBQUE7SUFDeEIsNEhBQTJCLENBQUE7SUFDM0Isc0dBQWdCLENBQUE7SUFDaEIsd0hBQXlCLENBQUE7SUFDekIsb0dBQWUsQ0FBQTtJQUNmLDRIQUEyQixDQUFBO0lBQzNCLDRGQUFXLENBQUE7SUFDWCx3R0FBaUIsQ0FBQTtJQUNqQixvR0FBZSxDQUFBO0lBQ2YsNEZBQVcsQ0FBQTtJQUNYLHNIQUF3QixDQUFBO0lBQ3hCLDhJQUFvQyxDQUFBO0lBQ3BDLHdHQUFpQixDQUFBO0lBQ2pCLG9IQUF1QixDQUFBO0lBQ3ZCLDhIQUE0QixDQUFBO0lBQzVCLDBJQUFrQyxDQUFBO0lBQ2xDLGtKQUFzQyxDQUFBO0lBQ3RDLHdHQUFpQixDQUFBO0lBQ2pCLDRIQUEyQixDQUFBO0lBQzNCLGtIQUFzQixDQUFBO0lBQ3RCLG9IQUF1QixDQUFBO0lBRXZCLDBJQUFrQyxDQUFBO0lBQ2xDLG9IQUF1QixDQUFBO0lBQ3ZCLHdJQUFpQyxDQUFBO0lBRWpDLGdKQUFxQyxDQUFBO0lBQ3JDLG9KQUF1QyxDQUFBO0lBQ3ZDLDhIQUE0QixDQUFBO0lBQzVCLHNKQUF3QyxDQUFBO0lBQ3hDLHNJQUFnQyxDQUFBO0lBQ2hDLGtKQUFzQyxDQUFBO0lBQ3RDLGtKQUFzQyxDQUFBO0lBQ3RDLGdKQUFxQyxDQUFBO0lBQ3JDLDhJQUFvQyxDQUFBO0lBQ3BDLGdKQUFxQyxDQUFBO0lBQ3JDLGdKQUFxQyxDQUFBO0lBRXJDLGtJQUE4QixDQUFBO0lBQzlCLG9IQUF1QixDQUFBO0lBQ3ZCLDhHQUFvQixDQUFBO0lBQ3BCLDhHQUFvQixDQUFBO0lBQ3BCLGtKQUFzQyxDQUFBO0lBQ3RDLHdHQUFpQixDQUFBO0lBQ2pCLDBIQUEwQixDQUFBO0lBQzFCLG9HQUFlLENBQUE7SUFDZixrSUFBOEIsQ0FBQTtJQUM5Qiw4SEFBNEIsQ0FBQTtJQUM1QixvSEFBdUIsQ0FBQTtJQUN2Qix3SkFBeUMsQ0FBQTtJQUN6Qyx3SUFBaUMsQ0FBQTtBQUNyQyxDQUFDLEVBcEdXLDJCQUEyQixHQUEzQixtQ0FBMkIsS0FBM0IsbUNBQTJCLFFBb0d0QztBQUVZLFFBQUEsOEJBQThCLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQywyQkFBMkIsQ0FBQyxDQUFDLE1BQU0sQ0FDNUYsQ0FBQyxHQUE4QixFQUFFLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxFQUFFLEVBQUU7SUFDN0MsR0FBRyxDQUFDLEdBQUcsQ0FBQyxHQUFHLEtBQUssQ0FBQztJQUVqQixPQUFPLEdBQUcsQ0FBQztBQUNmLENBQUMsRUFDRCxFQUFFLENBQ0wsQ0FBQyJ9
@@ -0,0 +1,54 @@
1
+ /// <reference types="node" />
2
+ import { DcapQuoteVerificationStatus } from "./consts";
3
+ export declare class DcapQuoteVerifyService {
4
+ private readonly quoteVerifier;
5
+ constructor();
6
+ static checkErrorOrThrow(result: DcapQuoteVerificationStatus): void;
7
+ extractQuoteFromCert(pemOrDerCert: Buffer): Promise<Buffer>;
8
+ validateQuoteVerifierEnclave(quote: Buffer): Promise<void>;
9
+ validateQuote({ quote, pemPckCertificate, pemIntermediateCrl, tcbInfoJson, qeIdentityJson, }: {
10
+ quote: Buffer;
11
+ pemPckCertificate: string;
12
+ pemIntermediateCrl: string;
13
+ tcbInfoJson: string;
14
+ qeIdentityJson: string;
15
+ }): Promise<void>;
16
+ validateEnclaveReport({ enclaveReport, enclaveIdentity, }: {
17
+ enclaveReport: Buffer;
18
+ enclaveIdentity: string;
19
+ }): Promise<void>;
20
+ libraryEnclaveGetVersion(): string;
21
+ libraryVersion(): string;
22
+ getQeCertificationData({ quote }: {
23
+ quote: Buffer;
24
+ }): Promise<{
25
+ pemCertChain?: string;
26
+ qeCertType?: number;
27
+ }>;
28
+ validatePckCertificate({ pemCertChain, pemRootCaCrl, pemIntermediateCaCrl, pemRootCaCertificate, expirationCheckDate, }: {
29
+ pemCertChain: string;
30
+ pemRootCaCrl: string;
31
+ pemIntermediateCaCrl: string;
32
+ pemRootCaCertificate: string;
33
+ expirationCheckDate: number;
34
+ }): Promise<void>;
35
+ validateTcbInfo({ tcbInfoJson, pemCertChain, pemRootCaCrl, pemRootCaCertificate, expirationCheckDate, }: {
36
+ tcbInfoJson: string;
37
+ pemCertChain: string;
38
+ pemRootCaCrl: string;
39
+ pemRootCaCertificate: string;
40
+ expirationCheckDate: number;
41
+ }): Promise<void>;
42
+ validateEnclaveIdentity({ enclaveIdentityJson, pemCertChain, pemRootCaCrl, pemRootCaCertificate, expirationCheckDate, }: {
43
+ enclaveIdentityJson: string;
44
+ pemCertChain: string;
45
+ pemRootCaCrl: string;
46
+ pemRootCaCertificate: string;
47
+ expirationCheckDate: number;
48
+ }): Promise<void>;
49
+ validatePckRevocationList({ pemCrl, pemCaCertChain, pemTrustedRootCaCert, }: {
50
+ pemCrl: string;
51
+ pemCaCertChain: string;
52
+ pemTrustedRootCaCert: string;
53
+ }): Promise<void>;
54
+ }
@@ -0,0 +1,69 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.DcapQuoteVerifyService = void 0;
4
+ const { SgxAttestationVerifier } = require("../../bindings/sgx-native/build/Release/sgx_native.node");
5
+ const consts_1 = require("./consts");
6
+ const errors_1 = require("./errors");
7
+ class DcapQuoteVerifyService {
8
+ constructor() {
9
+ this.quoteVerifier = new SgxAttestationVerifier();
10
+ }
11
+ static checkErrorOrThrow(result) {
12
+ if (result !== consts_1.DcapQuoteVerificationStatus.OK) {
13
+ throw new errors_1.AttestationDcapQuoteVerifyServiceError(consts_1.DcapQuoteVerificationStatusMap[result]);
14
+ }
15
+ }
16
+ async extractQuoteFromCert(pemOrDerCert) {
17
+ if (!pemOrDerCert?.length) {
18
+ throw new errors_1.AttestationDcapQuoteVerifyEnclaveError("empty certificate");
19
+ }
20
+ return this.quoteVerifier.extractQuoteFromCert(pemOrDerCert);
21
+ }
22
+ async validateQuoteVerifierEnclave(quote) {
23
+ if (!quote?.length) {
24
+ throw new errors_1.AttestationDcapQuoteVerifyEnclaveError("empty quote");
25
+ }
26
+ const verifyResult = this.quoteVerifier.verifyQuoteDcap(quote);
27
+ // https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteVerification/QvE/Include/sgx_qve_header.h:57
28
+ if (verifyResult === 0xa006) {
29
+ throw new errors_1.AttestationDcapQuoteVerifyEnclaveError(`The Quote verification failed due to an error in one of the input`);
30
+ }
31
+ if (verifyResult !== 0) {
32
+ throw new errors_1.AttestationDcapQuoteVerifyEnclaveError(`Quote verification failed. Verification result: 0x${Number(verifyResult).toString(16)}`);
33
+ }
34
+ }
35
+ async validateQuote({ quote, pemPckCertificate, pemIntermediateCrl, tcbInfoJson, qeIdentityJson, }) {
36
+ DcapQuoteVerifyService.checkErrorOrThrow(this.quoteVerifier.verifyQuote(quote, pemPckCertificate, pemIntermediateCrl, tcbInfoJson, qeIdentityJson));
37
+ }
38
+ async validateEnclaveReport({ enclaveReport, enclaveIdentity, }) {
39
+ DcapQuoteVerifyService.checkErrorOrThrow(this.quoteVerifier.verifyEnclaveReport(enclaveReport, enclaveIdentity));
40
+ }
41
+ libraryEnclaveGetVersion() {
42
+ return this.quoteVerifier.enclaveGetVersion();
43
+ }
44
+ libraryVersion() {
45
+ return this.quoteVerifier.getVersion();
46
+ }
47
+ async getQeCertificationData({ quote }) {
48
+ const [status, pemCertChain, qeCertType] = this.quoteVerifier.getQECertificationData(quote);
49
+ DcapQuoteVerifyService.checkErrorOrThrow(status);
50
+ return {
51
+ pemCertChain,
52
+ qeCertType,
53
+ };
54
+ }
55
+ async validatePckCertificate({ pemCertChain, pemRootCaCrl, pemIntermediateCaCrl, pemRootCaCertificate, expirationCheckDate, }) {
56
+ DcapQuoteVerifyService.checkErrorOrThrow(this.quoteVerifier.verifyPCKCertificate(pemCertChain, [pemRootCaCrl, pemIntermediateCaCrl], pemRootCaCertificate, expirationCheckDate));
57
+ }
58
+ async validateTcbInfo({ tcbInfoJson, pemCertChain, pemRootCaCrl, pemRootCaCertificate, expirationCheckDate, }) {
59
+ DcapQuoteVerifyService.checkErrorOrThrow(this.quoteVerifier.verifyTCBInfo(tcbInfoJson, pemCertChain, pemRootCaCrl, pemRootCaCertificate, expirationCheckDate));
60
+ }
61
+ async validateEnclaveIdentity({ enclaveIdentityJson, pemCertChain, pemRootCaCrl, pemRootCaCertificate, expirationCheckDate, }) {
62
+ DcapQuoteVerifyService.checkErrorOrThrow(this.quoteVerifier.verifyEnclaveIdentity(enclaveIdentityJson, pemCertChain, pemRootCaCrl, pemRootCaCertificate, expirationCheckDate));
63
+ }
64
+ async validatePckRevocationList({ pemCrl, pemCaCertChain, pemTrustedRootCaCert, }) {
65
+ DcapQuoteVerifyService.checkErrorOrThrow(this.quoteVerifier.verifyPCKRevocationList(pemCrl, pemCaCertChain, pemTrustedRootCaCert));
66
+ }
67
+ }
68
+ exports.DcapQuoteVerifyService = DcapQuoteVerifyService;
69
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGNhcC1xdW90ZS12ZXJpZnkuc2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZ3gtbmF0aXZlLW1vZHVsZS9kY2FwLXF1b3RlLXZlcmlmeS5zZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLE1BQU0sRUFBRSxzQkFBc0IsRUFBRSxHQUFHLE9BQU8sQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0FBQ3RHLHFDQUF1RjtBQUN2RixxQ0FBMEc7QUFxRDFHLE1BQWEsc0JBQXNCO0lBRy9CO1FBQ0ksSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLHNCQUFzQixFQUFFLENBQUM7SUFDdEQsQ0FBQztJQUVELE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxNQUFtQztRQUN4RCxJQUFJLE1BQU0sS0FBSyxvQ0FBMkIsQ0FBQyxFQUFFLEVBQUU7WUFDM0MsTUFBTSxJQUFJLCtDQUFzQyxDQUFDLHVDQUE4QixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7U0FDNUY7SUFDTCxDQUFDO0lBRUQsS0FBSyxDQUFDLG9CQUFvQixDQUFDLFlBQW9CO1FBQzNDLElBQUksQ0FBQyxZQUFZLEVBQUUsTUFBTSxFQUFFO1lBQ3ZCLE1BQU0sSUFBSSwrQ0FBc0MsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1NBQ3pFO1FBRUQsT0FBTyxJQUFJLENBQUMsYUFBYSxDQUFDLG9CQUFvQixDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFFRCxLQUFLLENBQUMsNEJBQTRCLENBQUMsS0FBYTtRQUM1QyxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRTtZQUNoQixNQUFNLElBQUksK0NBQXNDLENBQUMsYUFBYSxDQUFDLENBQUM7U0FDbkU7UUFFRCxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUUvRCw0SEFBNEg7UUFDNUgsSUFBSSxZQUFZLEtBQUssTUFBTSxFQUFFO1lBQ3pCLE1BQU0sSUFBSSwrQ0FBc0MsQ0FDNUMsbUVBQW1FLENBQ3RFLENBQUM7U0FDTDtRQUVELElBQUksWUFBWSxLQUFLLENBQUMsRUFBRTtZQUNwQixNQUFNLElBQUksK0NBQXNDLENBQzVDLHFEQUFxRCxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQzNGLENBQUM7U0FDTDtJQUNMLENBQUM7SUFFRCxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQ2hCLEtBQUssRUFDTCxpQkFBaUIsRUFDakIsa0JBQWtCLEVBQ2xCLFdBQVcsRUFDWCxjQUFjLEdBT2pCO1FBQ0csc0JBQXNCLENBQUMsaUJBQWlCLENBQ3BDLElBQUksQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQUUsY0FBYyxDQUFDLENBQzVHLENBQUM7SUFDTixDQUFDO0lBRUQsS0FBSyxDQUFDLHFCQUFxQixDQUFDLEVBQ3hCLGFBQWEsRUFDYixlQUFlLEdBSWxCO1FBQ0csc0JBQXNCLENBQUMsaUJBQWlCLENBQ3BDLElBQUksQ0FBQyxhQUFhLENBQUMsbUJBQW1CLENBQUMsYUFBYSxFQUFFLGVBQWUsQ0FBQyxDQUN6RSxDQUFDO0lBQ04sQ0FBQztJQUVELHdCQUF3QjtRQUNwQixPQUFPLElBQUksQ0FBQyxhQUFhLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztJQUNsRCxDQUFDO0lBRUQsY0FBYztRQUNWLE9BQU8sSUFBSSxDQUFDLGFBQWEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUMzQyxDQUFDO0lBRUQsS0FBSyxDQUFDLHNCQUFzQixDQUFDLEVBQUUsS0FBSyxFQUFxQjtRQUlyRCxNQUFNLENBQUMsTUFBTSxFQUFFLFlBQVksRUFBRSxVQUFVLENBQUMsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLHNCQUFzQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRTVGLHNCQUFzQixDQUFDLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRWpELE9BQU87WUFDSCxZQUFZO1lBQ1osVUFBVTtTQUNiLENBQUM7SUFDTixDQUFDO0lBRUQsS0FBSyxDQUFDLHNCQUFzQixDQUFDLEVBQ3pCLFlBQVksRUFDWixZQUFZLEVBQ1osb0JBQW9CLEVBQ3BCLG9CQUFvQixFQUNwQixtQkFBbUIsR0FPdEI7UUFDRyxzQkFBc0IsQ0FBQyxpQkFBaUIsQ0FDcEMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsQ0FDbkMsWUFBWSxFQUNaLENBQUMsWUFBWSxFQUFFLG9CQUFvQixDQUFDLEVBQ3BDLG9CQUFvQixFQUNwQixtQkFBbUIsQ0FDdEIsQ0FDSixDQUFDO0lBQ04sQ0FBQztJQUVELEtBQUssQ0FBQyxlQUFlLENBQUMsRUFDbEIsV0FBVyxFQUNYLFlBQVksRUFDWixZQUFZLEVBQ1osb0JBQW9CLEVBQ3BCLG1CQUFtQixHQU90QjtRQUNHLHNCQUFzQixDQUFDLGlCQUFpQixDQUNwQyxJQUFJLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FDNUIsV0FBVyxFQUNYLFlBQVksRUFDWixZQUFZLEVBQ1osb0JBQW9CLEVBQ3BCLG1CQUFtQixDQUN0QixDQUNKLENBQUM7SUFDTixDQUFDO0lBRUQsS0FBSyxDQUFDLHVCQUF1QixDQUFDLEVBQzFCLG1CQUFtQixFQUNuQixZQUFZLEVBQ1osWUFBWSxFQUNaLG9CQUFvQixFQUNwQixtQkFBbUIsR0FPdEI7UUFDRyxzQkFBc0IsQ0FBQyxpQkFBaUIsQ0FDcEMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxxQkFBcUIsQ0FDcEMsbUJBQW1CLEVBQ25CLFlBQVksRUFDWixZQUFZLEVBQ1osb0JBQW9CLEVBQ3BCLG1CQUFtQixDQUN0QixDQUNKLENBQUM7SUFDTixDQUFDO0lBRUQsS0FBSyxDQUFDLHlCQUF5QixDQUFDLEVBQzVCLE1BQU0sRUFDTixjQUFjLEVBQ2Qsb0JBQW9CLEdBS3ZCO1FBQ0csc0JBQXNCLENBQUMsaUJBQWlCLENBQ3BDLElBQUksQ0FBQyxhQUFhLENBQUMsdUJBQXVCLENBQUMsTUFBTSxFQUFFLGNBQWMsRUFBRSxvQkFBb0IsQ0FBQyxDQUMzRixDQUFDO0lBQ04sQ0FBQztDQUNKO0FBbExELHdEQWtMQyJ9