@super-protocol/pki-attestation-engine 5.1.0-beta1 → 5.1.0-beta2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -6,6 +6,8 @@ export interface TdxAzureEvidenceV1 {
|
|
|
6
6
|
}
|
|
7
7
|
export declare const encodeTdxAzureEvidence: (token: string) => Buffer;
|
|
8
8
|
export declare const parseTdxAzureEvidence: (evidence: Buffer) => TdxAzureEvidenceV1;
|
|
9
|
+
/** vTPM SHA-256 PCRs mixed into Azure TDX mrEnclave. PCR[6] is omitted: Azure logs vmUniqueId there. */
|
|
10
|
+
export declare const AZURE_TDX_MR_ENCLAVE_PCR_INDEXES: readonly [0, 1, 2, 3, 4, 5, 7];
|
|
9
11
|
export declare const computeAzureTdxMrEnclave: (tdAttributesHex: string, mrtdHex: string, pcrSha256Hex: string[]) => Buffer;
|
|
10
12
|
export declare const verifyMaaJwt: (token: string) => Promise<Record<string, unknown>>;
|
|
11
13
|
export declare const validateAzureTdxClaims: (claims: Record<string, unknown>) => {
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.validateAzureTdxClaims = exports.verifyMaaJwt = exports.computeAzureTdxMrEnclave = exports.parseTdxAzureEvidence = exports.encodeTdxAzureEvidence = exports.TDX_AZURE_EVIDENCE_FORMAT = void 0;
|
|
3
|
+
exports.validateAzureTdxClaims = exports.verifyMaaJwt = exports.computeAzureTdxMrEnclave = exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES = exports.parseTdxAzureEvidence = exports.encodeTdxAzureEvidence = exports.TDX_AZURE_EVIDENCE_FORMAT = void 0;
|
|
4
4
|
const crypto_1 = require("crypto");
|
|
5
5
|
exports.TDX_AZURE_EVIDENCE_FORMAT = 'tdx-azure-maa-v1';
|
|
6
6
|
const encodeTdxAzureEvidence = (token) => Buffer.from(JSON.stringify({
|
|
@@ -28,14 +28,19 @@ const hexToBuffer = (hex, expectedBytes) => {
|
|
|
28
28
|
return buffer;
|
|
29
29
|
};
|
|
30
30
|
const decodeJwtPart = (part) => JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
|
|
31
|
+
/** vTPM SHA-256 PCRs mixed into Azure TDX mrEnclave. PCR[6] is omitted: Azure logs vmUniqueId there. */
|
|
32
|
+
exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES = [
|
|
33
|
+
0, 1, 2, 3, 4, 5, 7,
|
|
34
|
+
];
|
|
31
35
|
const computeAzureTdxMrEnclave = (tdAttributesHex, mrtdHex, pcrSha256Hex) => {
|
|
32
|
-
|
|
33
|
-
|
|
36
|
+
const lastIndex = exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES[exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES.length - 1];
|
|
37
|
+
if (pcrSha256Hex.length <= lastIndex) {
|
|
38
|
+
throw new Error(`tdx-azure mrEnclave requires SHA-256 PCR[0]..PCR[${lastIndex}] (PCR[6] is not mixed in)`);
|
|
34
39
|
}
|
|
35
40
|
const parts = [
|
|
36
41
|
hexToBuffer(tdAttributesHex, 8),
|
|
37
42
|
hexToBuffer(mrtdHex, 48),
|
|
38
|
-
...
|
|
43
|
+
...exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES.map((index) => hexToBuffer(pcrSha256Hex[index], 32)),
|
|
39
44
|
];
|
|
40
45
|
return (0, crypto_1.createHash)('sha256').update(Buffer.concat(parts)).digest();
|
|
41
46
|
};
|
|
@@ -132,4 +137,4 @@ const validateAzureTdxClaims = (claims) => {
|
|
|
132
137
|
};
|
|
133
138
|
};
|
|
134
139
|
exports.validateAzureTdxClaims = validateAzureTdxClaims;
|
|
135
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
140
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGR4QXp1cmVFdmlkZW5jZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9henVyZS90ZHhBenVyZUV2aWRlbmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUFnRztBQUVuRixRQUFBLHlCQUF5QixHQUFHLGtCQUFrQixDQUFDO0FBT3JELE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxLQUFhLEVBQVUsRUFBRSxDQUM1RCxNQUFNLENBQUMsSUFBSSxDQUNQLElBQUksQ0FBQyxTQUFTLENBQUM7SUFDWCxNQUFNLEVBQUUsaUNBQXlCO0lBQ2pDLEtBQUs7Q0FDcUIsQ0FBQyxFQUMvQixNQUFNLENBQ1QsQ0FBQztBQVBPLFFBQUEsc0JBQXNCLDBCQU83QjtBQUVDLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxRQUFnQixFQUFzQixFQUFFO0lBQzFFLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBZ0MsQ0FBQztJQUNwRixJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssaUNBQXlCLElBQUksT0FBTyxNQUFNLENBQUMsS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBQ0QsT0FBTyxNQUE0QixDQUFDO0FBQ3hDLENBQUMsQ0FBQztBQU5XLFFBQUEscUJBQXFCLHlCQU1oQztBQUVGLE1BQU0sV0FBVyxHQUFHLENBQUMsR0FBVyxFQUFFLGFBQXNCLEVBQVUsRUFBRTtJQUNoRSxNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztJQUMvRCxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksS0FBSyxDQUFDLHNCQUFzQixHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM5QyxJQUFJLGFBQWEsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksS0FBSyxDQUNYLFlBQVksYUFBYSxlQUFlLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxFQUFFLENBQzFFLENBQUM7SUFDTixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxJQUFZLEVBQVcsRUFBRSxDQUM1QyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBRWhFLHdHQUF3RztBQUMzRixRQUFBLGdDQUFnQyxHQUFHO0lBQzVDLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7Q0FDYixDQUFDO0FBRUosTUFBTSx3QkFBd0IsR0FBRyxDQUNwQyxlQUF1QixFQUN2QixPQUFlLEVBQ2YsWUFBc0IsRUFDaEIsRUFBRTtJQUNSLE1BQU0sU0FBUyxHQUFHLHdDQUFnQyxDQUFDLHdDQUFnQyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNoRyxJQUFJLFlBQVksQ0FBQyxNQUFNLElBQUksU0FBUyxFQUFFLENBQUM7UUFDbkMsTUFBTSxJQUFJLEtBQUssQ0FDWCxvREFBb0QsU0FBUyw0QkFBNEIsQ0FDNUYsQ0FBQztJQUNOLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRztRQUNWLFdBQVcsQ0FBQyxlQUFlLEVBQUUsQ0FBQyxDQUFDO1FBQy9CLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ3hCLEdBQUcsd0NBQWdDLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FDOUMsV0FBVyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FDdkM7S0FDSixDQUFDO0lBQ0YsT0FBTyxJQUFBLG1CQUFVLEVBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUN0RSxDQUFDLENBQUM7QUFuQlcsUUFBQSx3QkFBd0IsNEJBbUJuQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxNQUErQixFQUFZLEVBQUU7SUFDdEUsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDMUQsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDNUUsT0FBTyxNQUFrQixDQUFDO0lBQzlCLENBQUM7SUFDRCxJQUFJLE1BQU0sSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN2QyxNQUFNLE1BQU0sR0FBSSxNQUErQixDQUFDLE1BQU0sQ0FBQztRQUN2RCxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsT0FBTyxJQUFJLEtBQUssUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM1RSxPQUFPLE1BQWtCLENBQUM7UUFDOUIsQ0FBQztJQUNMLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7QUFDL0QsQ0FBQyxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FDakIsTUFBK0IsRUFDUixFQUFFO0lBQ3pCLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQzVDLElBQUksTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3ZDLE9BQU8sTUFBaUMsQ0FBQztJQUM3QyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsS0FBSyxFQUFFLEdBQVcsRUFBK0MsRUFBRTtJQUNqRixNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDekUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNmLE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxPQUFPLENBQUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQXVDLENBQUM7QUFDekUsQ0FBQyxDQUFDO0FBRUssTUFBTSxZQUFZLEdBQUcsS0FBSyxFQUM3QixLQUFhLEVBQ21CLEVBQUU7SUFDbEMsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUMvQixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFpRCxDQUFDO0lBQ3ZGLE1BQU0sT0FBTyxHQUFHLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQTRCLENBQUM7SUFDbkUsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMsNEJBQTRCLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDO0lBQ3hCLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsMENBQTBDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbkYsTUFBTSxJQUFJLEtBQUssQ0FBQywwQkFBMEIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEdBQUcsSUFBSSxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUM7SUFDaEUsSUFBSSxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM3RSxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELE1BQU0sSUFBSSxHQUFHLE1BQU0sU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3RDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0UsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ1AsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxJQUFBLHdCQUFlLEVBQUM7UUFDeEIsR0FBRyxFQUFFLEdBQWdDO1FBQ3JDLE1BQU0sRUFBRSxLQUFLO0tBQ2hCLENBQUMsQ0FBQztJQUNILE1BQU0sRUFBRSxHQUFHLElBQUEsZUFBTSxFQUNiLFlBQVksRUFDWixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQ3RDLEdBQUcsRUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLENBQUMsQ0FDckMsQ0FBQztJQUNGLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNOLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUM7QUFDbkIsQ0FBQyxDQUFDO0FBdkNXLFFBQUEsWUFBWSxnQkF1Q3ZCO0FBRUssTUFBTSxzQkFBc0IsR0FBRyxDQUNsQyxNQUErQixFQUNRLEVBQUU7SUFDekMsTUFBTSxHQUFHLEdBQUcsWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ2pDLElBQUksR0FBRyxDQUFDLHlCQUF5QixDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDMUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFDRCxJQUFJLEdBQUcsQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLHFCQUFxQixFQUFFLENBQUM7UUFDMUQsTUFBTSxJQUFJLEtBQUssQ0FDWCxrQ0FBa0MsTUFBTSxDQUFDLEdBQUcsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDLEVBQUUsQ0FDNUUsQ0FBQztJQUNOLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMscUJBQXFCLENBQUMsSUFBSSxNQUFNLENBQUMscUJBQXFCLENBQUMsQ0FBQztJQUM5RSxJQUFJLFNBQVMsSUFBSSxTQUFTLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQkFBb0IsTUFBTSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxDQUUvQyxDQUFDO0lBQ2hCLE1BQU0sV0FBVyxHQUFHLE9BQU8sRUFBRSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzNDLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDbEMsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxXQUFXLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDMUMsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBRUQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzVELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFDM0MsTUFBTSxJQUFJLEdBQUcsbUJBQW1CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDekMsTUFBTSxTQUFTLEdBQUcsSUFBQSxnQ0FBd0IsRUFBQyxZQUFZLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBRXJFLE9BQU87UUFDSCxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2xDLFNBQVM7S0FDWixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBdENXLFFBQUEsc0JBQXNCLDBCQXNDakMifQ==
|