create-evda 0.1.10 → 0.1.11

package/lib/tdx-attestation.mjs

@@ -23,12 +23,19 @@
 //   8. the nonce is one this phone issued, unused, and young enough;
 //   9. REPORTDATA equals reportDataFor(nonce, tlsPublicKey), which binds the quote to the TLS key the
 //      phone then pins.
+//  10. when the VM names a key-wrapping key (lib/attested-wrap.mjs), REPORTDATA also binds it, so the
+//      key a client wraps circle keys to is one the attested VM made, not one the host operator chose.
 //
 // The binding, exactly: REPORTDATA (64 bytes) = SHA-512( "EVDA-TDX-REPORTDATA-v1" || 0x00 ||
 // nonce (32 bytes) || SPKI DER of the TLS public key ). The nonce has a fixed length and SPKI DER
 // carries its own length, so the concatenation is unambiguous. The VM computes the same value with
 // the same function when it asks the TDX module for a quote.
 //
+// With a key-wrapping key, REPORTDATA = SHA-512( "EVDA-TDX-REPORTDATA-v2" || 0x00 || nonce (32 bytes) ||
+// SPKI DER of the TLS public key || the X25519 wrap public key (32 raw bytes) ). The wrap key has a fixed
+// length and comes last, after a self-delimiting SPKI, and the tag differs, so neither form can be read
+// as the other.
+//
 // Not checked here yet: certificate revocation (Intel's PCK and root CRLs), quote v5 (refused as
 // unknown rather than half-checked), the TD relaunch advice v5 quotes carry, and whether the expected
 // measurements are themselves in Sigstore's log (lib/measurement-log.mjs checks a digest; tying the
@@ -71,11 +78,20 @@ const spkiDer = (key) => {
   return createPublicKey(key).export({ type: "spki", format: "der" });
 };
 
-/** The 64 bytes a TD must put in REPORTDATA to bind `nonce` (32 bytes) and `tlsPublicKey` to its quote. */
-export function reportDataFor(nonce, tlsPublicKey) {
+/** The domain tag when REPORTDATA also binds the VM's key-wrapping key. */
+export const REPORTDATA_WRAP_TAG = "EVDA-TDX-REPORTDATA-v2";
+
+/**
+ * The 64 bytes a TD must put in REPORTDATA to bind `nonce` (32 bytes) and `tlsPublicKey` to its quote,
+ * and, when given, `wrapPublicKey` (the raw 32-byte X25519 key the VM made inside itself).
+ */
+export function reportDataFor(nonce, tlsPublicKey, wrapPublicKey) {
   const n = Buffer.from(nonce);
   if (n.length !== 32) throw new Error("the nonce must be 32 bytes");
-  return createHash("sha512").update(Buffer.concat([Buffer.from(REPORTDATA_TAG, "ascii"), Buffer.from([0]), n, spkiDer(tlsPublicKey)])).digest();
+  if (wrapPublicKey == null) return createHash("sha512").update(Buffer.concat([Buffer.from(REPORTDATA_TAG, "ascii"), Buffer.from([0]), n, spkiDer(tlsPublicKey)])).digest();
+  const w = Buffer.from(wrapPublicKey);
+  if (w.length !== 32) throw new Error("the wrap key must be 32 bytes");
+  return createHash("sha512").update(Buffer.concat([Buffer.from(REPORTDATA_WRAP_TAG, "ascii"), Buffer.from([0]), n, spkiDer(tlsPublicKey), w])).digest();
 }
 
 /**
@@ -381,8 +397,10 @@ function checkQuote({ quote, collateral, minTcb, now, trust }) {
  * nonce: the 32 bytes the phone sent; nonces: the createNonceBook that issued it (spent here, pass or fail).
  * tlsPublicKey: the TLS server key of this connection (KeyObject, PEM, or SPKI DER).
  * expected: { mrtd, rtmr0, rtmr1, rtmr2, rtmr3 } as hex. Every one must be named.
+ * wrapPublicKey: the VM's key-wrapping key as the host named it (32 raw bytes), or absent. When given,
+ * the quote must bind it too, and the result names it.
  */
-export function verifyTdxAttestation({ quote, nonce, nonces, tlsPublicKey, expected, minTcb, collateral, now, trust = TDX_TRUST } = {}) {
+export function verifyTdxAttestation({ quote, nonce, nonces, tlsPublicKey, wrapPublicKey, expected, minTcb, collateral, now, trust = TDX_TRUST } = {}) {
   try {
     if (!nonces?.take) return fail("no nonce book was given, so freshness cannot be checked");
     const at = now === undefined ? undefined : new Date(now).getTime();
@@ -400,12 +418,14 @@ export function verifyTdxAttestation({ quote, nonce, nonces, tlsPublicKey, expec
     // 7. The code is the code expected.
     for (const n of MEASUREMENT_NAMES) if (r.body[n] !== expected[n]) return fail(`${n.toUpperCase()} is ${r.body[n].slice(0, 16)}..., not the expected ${expected[n].slice(0, 16)}...`);
 
-    // 9. The quote is for this nonce and this TLS key.
-    const want = reportDataFor(nonce, tlsPublicKey);
-    if (!timingSafeEqual(want, r.body.reportData)) return fail("REPORTDATA does not bind this nonce and this TLS key");
+    // 9 and 10. The quote is for this nonce, this TLS key and, when named, this wrap key.
+    const want = reportDataFor(nonce, tlsPublicKey, wrapPublicKey);
+    if (!timingSafeEqual(want, r.body.reportData)) return fail(wrapPublicKey == null ? "REPORTDATA does not bind this nonce and this TLS key" : "REPORTDATA does not bind this nonce, this TLS key and this wrap key");
 
     const measurements = Object.fromEntries(MEASUREMENT_NAMES.map((n) => [n, r.body[n]]));
-    return { ok: true, measurements, tcb: r.tcb, tlsPublicKeySha256: sha256(spkiDer(tlsPublicKey)).toString("hex") };
+    const out = { ok: true, measurements, tcb: r.tcb, tlsPublicKeySha256: sha256(spkiDer(tlsPublicKey)).toString("hex") };
+    if (wrapPublicKey != null) out.wrapPublicKey = Buffer.from(wrapPublicKey);
+    return out;
   } catch (err) {
     return fail(`the attestation could not be checked: ${err.message}`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-evda",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "type": "module",
   "description": "The person layer over the substrate: scaffold and operate an EVDA, a directory that knows what it is. Plain files are the truth, the tooling is optional, and there are no runtime dependencies.",
   "bin": {