create-evda 0.1.9 → 0.1.11

package/lib/takeout.mjs

@@ -0,0 +1,169 @@
+// Google Takeout's sidecars (HQ-1368). Takeout writes a `.json` file beside each photo and each Keep
+// note, holding what the app knew about it: when a photo was taken, its caption, when a note was made
+// and last edited. Gathered as files of their own they became captures while their photo or note went
+// somewhere else (the 2026-09-27 trial). So a gather pairs each sidecar with the file it describes,
+// folds the sidecar's date and caption into that file's entry, and never places the sidecar itself.
+//
+// The names Takeout gives them, all paired here:
+//   IMG_1.jpg.json                                  the older name
+//   IMG_1.jpg.supplemental-metadata.json            the newer one
+//   IMG_1.jpg.supplemental-metad.json, .supp.json   cut short: Takeout caps a name near 51 characters
+//   <the first 40-odd characters of a long name>.json   the photo's own name cut short
+//   IMG_1.jpg(1).json, IMG_1.jpg.supplemental-metadata(1).json   the sidecar of IMG_1(1).jpg
+//   Note.json                                       a Keep note's, beside Note.html
+// A photo's `-edited` copy has no sidecar of its own and shares its original's.
+//
+// What is folded, and what is not: a photo's date taken (`photoTakenTime.timestamp`, UTC epoch seconds,
+// kept to the second) and whether it has a caption; a Keep note's created and edited times. Its place
+// (`geoData`) and the people Google tagged in it are never read into the proposal or the record. The
+// caption is the owner's words, so the proposal only says there is one; apply reads it again from the
+// sidecar, unchanged since the gather, and keeps it on the record's gathered list beside the photo.
+//
+//   pairSidecars(files, read)   { folded: Map<rel, facts>, sidecars: [{ rel, why, of }] }
+//   captionOf(buf)              the caption a photo sidecar holds, or null
+//
+// EVDA_GATHER_FALSIFY=sidecars-as-entries turns the pairing off, so the tests can show their checks fail
+// without it (TAKEOUT_FALSIFY_MODES).
+
+import { createHash } from "node:crypto";
+import { basename, dirname, extname } from "node:path";
+import { secretShape } from "./references.mjs";
+
+export const TAKEOUT_FALSIFY_MODES = ["sidecars-as-entries"];
+const falsified = (mode) => (process.env.EVDA_GATHER_FALSIFY ?? "").split(",").map((s) => s.trim()).includes(mode);
+const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
+
+// The files a sidecar describes: what Takeout exports from Photos, and Keep's notes.
+const MEDIA_EXT = new Set([".jpg", ".jpeg", ".png", ".gif", ".heic", ".heif", ".webp", ".tif", ".tiff", ".bmp", ".dng", ".raw", ".cr2", ".nef", ".arw", ".mp4", ".mov", ".m4v", ".avi", ".3gp", ".mkv", ".mpg", ".webm", ".mp"]);
+const NOTE_EXT = new Set([".html", ".htm", ".txt", ".md"]);
+const SUPPLEMENTAL = "supplemental-metadata";
+// Takeout's sidecar names run to about 51 characters; a photo's own name is cut from about 46.
+const CUT_AT = 30;
+const SIDECAR_MAX = 1024 * 1024;
+
+// The name a sidecar describes, from the sidecar's own name: { target, n, marked }, or null for a name
+// that is not `.json`. `n` is Takeout's "(1)" copy number; `marked` says the name carries the
+// supplemental-metadata marker, whole or cut short.
+export function sidecarTarget(name) {
+  if (!/\.json$/i.test(name)) return null;
+  let stem = name.slice(0, -5);
+  let n = null;
+  const copy = /\((\d+)\)$/.exec(stem);
+  if (copy) { n = copy[1]; stem = stem.slice(0, copy.index); }
+  let marked = false;
+  const tail = /\.([a-z-]*)$/i.exec(stem);
+  if (tail && SUPPLEMENTAL.startsWith(tail[1].toLowerCase())) {
+    const before = stem.slice(0, tail.index);
+    if (/\.[a-z0-9]{2,5}$/i.test(before) || tail[1].length >= 4) { stem = before; marked = true; }
+  }
+  return { target: stem, n, marked };
+}
+
+// What kind of Takeout file a parsed JSON value is: "photo", "keep", "album", or null.
+export function takeoutShape(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return null;
+  if (v.photoTakenTime || (v.creationTime && (v.title !== undefined || v.imageViews !== undefined))) return "photo";
+  if (v.createdTimestampUsec !== undefined || v.userEditedTimestampUsec !== undefined) return "keep";
+  if (v.albumData || (v.title !== undefined && v.date?.timestamp !== undefined && v.access !== undefined)) return "album";
+  return null;
+}
+
+// Seconds or microseconds since the epoch, as Takeout writes them, to an ISO time in UTC.
+const iso = (ms) => new Date(ms).toISOString().replace(/\.000Z$/, "Z");
+const seconds = (x) => (/^\d{1,12}$/.test(String(x ?? "").trim()) ? Number(String(x).trim()) : null);
+const usec = (x) => (/^\d{1,18}$/.test(String(x ?? "").trim()) ? Math.floor(Number(String(x).trim()) / 1000) : null);
+
+// The facts a sidecar folds into its file's entry. Nothing from geoData or people is read.
+function factsOf(v, shape) {
+  const out = {};
+  if (shape === "photo") {
+    const e = seconds(v.photoTakenTime?.timestamp);
+    if (e !== null) { out.takenEpoch = e; out.taken = iso(e * 1000); }
+    if (captionText(v)) out.caption = true;
+  } else if (shape === "keep") {
+    const c = usec(v.createdTimestampUsec);
+    const e = usec(v.userEditedTimestampUsec);
+    if (c !== null && c > 0) out.created = iso(c);
+    if (e !== null && e > 0) out.edited = iso(e);
+  }
+  return out;
+}
+
+// A caption, unless it is empty or shaped like a secret (then it is folded nowhere).
+function captionText(v) {
+  const t = typeof v?.description === "string" ? v.description.trim() : "";
+  if (!t || t.split("\n").some(secretShape)) return null;
+  return t;
+}
+
+export function captionOf(buf) {
+  try { return captionText(JSON.parse(buf.toString("utf8"))); } catch { return null; }
+}
+
+const withN = (name, n) => {
+  const ext = extname(name);
+  return ext ? `${name.slice(0, -ext.length)}(${n})${ext}` : `${name}(${n})`;
+};
+
+// Pair every sidecar in a walked source with the file it describes. `files` are the walk's
+// { rel, abs, size }, `read(abs)` their bytes. Returns { folded, sidecars }: `folded` maps a file's rel
+// to the facts its sidecar gave it, `sidecars` lists every sidecar with why it was not placed and, when
+// it has one, the file it describes (`of`).
+export function pairSidecars(files, read) {
+  const folded = new Map();
+  const sidecars = [];
+  if (falsified("sidecars-as-entries")) return { folded, sidecars };
+  const byDir = new Map();
+  for (const f of files) {
+    const d = dirname(f.rel);
+    byDir.set(d, [...(byDir.get(d) ?? []), f]);
+  }
+  for (const [dir, here] of byDir) {
+    const others = here.filter((f) => !/\.json$/i.test(f.rel));
+    const names = new Map(others.map((f) => [basename(f.rel), f]));
+    for (const f of here) {
+      const name = basename(f.rel);
+      const t = sidecarTarget(name);
+      if (!t) continue;
+      let v = null;
+      let bad = null;
+      if (f.size > SIDECAR_MAX) bad = "too large to be a sidecar";
+      else {
+        const text = read(f.abs).toString("utf8");
+        try { v = JSON.parse(text); } catch { bad = "not valid JSON"; }
+      }
+      const shape = v ? takeoutShape(v) : null;
+      const named = t.marked || MEDIA_EXT.has(extname(t.target).toLowerCase()) || NOTE_EXT.has(extname(t.target).toLowerCase());
+      // A .json that is neither shaped nor named like a sidecar is an ordinary file of the pile.
+      if (!shape && !named) continue;
+      if (shape === "album") { sidecars.push({ rel: f.rel, why: "Google Photos' details of the album this folder holds; not an entry of its own", sidecar: true }); continue; }
+      // The file it describes, in this folder.
+      let match = null;
+      if (t.n) match = names.get(withN(t.target, t.n)) ?? null;
+      else match = names.get(t.target) ?? null;
+      if (!match && !t.n) {
+        const same = others.filter((o) => basename(o.rel, extname(o.rel)) === t.target);
+        const notes = same.filter((o) => NOTE_EXT.has(extname(o.rel).toLowerCase()));
+        match = (notes.length === 1 ? notes[0] : same.length === 1 ? same[0] : null);
+      }
+      if (!match && !t.n && t.target.length >= CUT_AT) {
+        const cut = others.filter((o) => basename(o.rel).startsWith(t.target));
+        if (cut.length === 1) match = cut[0];
+      }
+      if (!match) {
+        sidecars.push({ rel: f.rel, why: bad ? `a Takeout sidecar that is ${bad}, and no file it describes is beside it; nothing read from it` : `a Takeout sidecar for ${t.n ? withN(t.target, t.n) : t.target}, which is not in the pile; placed nowhere`, sidecar: true, unmatched: true });
+        continue;
+      }
+      const facts = bad ? {} : factsOf(v, shape ?? "photo");
+      sidecars.push({ rel: f.rel, of: match.rel, why: bad ? `a Takeout sidecar for ${basename(match.rel)} that is ${bad}; nothing read from it, and ${basename(match.rel)} is placed without it` : `Google Takeout's details of ${basename(match.rel)}, folded into its entry`, sidecar: true, ...(bad ? { malformed: true } : {}) });
+      if (bad) continue;
+      const fold = { sidecar: f.rel, sha256: sha256(read(f.abs)), ...facts };
+      folded.set(match.rel, fold);
+      // A photo's edited copy has no sidecar of its own: it is the same moment.
+      const ext = extname(match.rel);
+      const edited = names.get(`${basename(match.rel, ext)}-edited${ext}`);
+      if (edited && !folded.has(edited.rel)) folded.set(edited.rel, { ...fold, sharedWith: match.rel });
+    }
+  }
+  return { folded, sidecars };
+}

package/lib/tdx-attestation.mjs

@@ -0,0 +1,432 @@
+// Is the VM the phone is about to talk to an Intel TDX confidential VM running EVÐA's image, with
+// debug off, on a patched platform, and holding the TLS key this connection uses?
+// (HQ-2083, Spec 08 section 8: "What the client checks before sending anything".)
+//
+// The phone runs this before it sends a hosted EVÐA anything. The claim it backs is "EVÐA's operators
+// cannot read your record". It does not back "no one can": physical attacks on the server (TEE.fail,
+// DDRop) sit outside what a quote can prove. This file is the reference the Swift port follows, and
+// its tests run against a real production quote with its chain to Intel's real root, so the port can
+// replay the same fixture.
+//
+// What it checks, all offline. Collateral is passed in and nothing here touches the network:
+//   1. the quote is a TDX quote v4 with an ECDSA P-256 attestation key and Intel's QE vendor id;
+//   2. the attestation key signs the header and TD report body;
+//   3. the PCK leaf signs the QE report, and the leaf chains through Intel's PCK CA to the pinned
+//      Intel SGX root (lib/tdx-trust.json), every certificate valid at `now`;
+//   4. the QE report's data is SHA-256(attestation key || QE auth data), so the key that signed the
+//      quote is the one the QE vouched for;
+//   5. the QE is Intel's (QE identity: MRSIGNER, ISVPRODID, masked attributes and MISCSELECT), and
+//      Intel's TCB info for this FMSPC puts the platform at a level the policy allows; both
+//      documents are signed by Intel's TCB signing key, chained to the same root, and current at `now`;
+//   6. the TD's debug bit is off;
+//   7. MRTD and RTMR0 to RTMR3 equal the expected set;
+//   8. the nonce is one this phone issued, unused, and young enough;
+//   9. REPORTDATA equals reportDataFor(nonce, tlsPublicKey), which binds the quote to the TLS key the
+//      phone then pins.
+//  10. when the VM names a key-wrapping key (lib/attested-wrap.mjs), REPORTDATA also binds it, so the
+//      key a client wraps circle keys to is one the attested VM made, not one the host operator chose.
+//
+// The binding, exactly: REPORTDATA (64 bytes) = SHA-512( "EVDA-TDX-REPORTDATA-v1" || 0x00 ||
+// nonce (32 bytes) || SPKI DER of the TLS public key ). The nonce has a fixed length and SPKI DER
+// carries its own length, so the concatenation is unambiguous. The VM computes the same value with
+// the same function when it asks the TDX module for a quote.
+//
+// With a key-wrapping key, REPORTDATA = SHA-512( "EVDA-TDX-REPORTDATA-v2" || 0x00 || nonce (32 bytes) ||
+// SPKI DER of the TLS public key || the X25519 wrap public key (32 raw bytes) ). The wrap key has a fixed
+// length and comes last, after a self-delimiting SPKI, and the tag differs, so neither form can be read
+// as the other.
+//
+// Not checked here yet: certificate revocation (Intel's PCK and root CRLs), quote v5 (refused as
+// unknown rather than half-checked), the TD relaunch advice v5 quotes carry, and whether the expected
+// measurements are themselves in Sigstore's log (lib/measurement-log.mjs checks a digest; tying the
+// expected MRTD and RTMRs to a logged statement is a later slice).
+//
+// Every failure returns { ok: false, reason } in words; nothing a quote contains can make it throw.
+
+import { createHash, createPublicKey, KeyObject, randomBytes, timingSafeEqual, verify as verifySig, X509Certificate } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { derTlv as tlv, derChildren as children, derOid as oid } from "./measurement-log.mjs";
+
+export const TDX_TRUST = JSON.parse(readFileSync(new URL("./tdx-trust.json", import.meta.url), "utf8"));
+
+/** The domain tag in front of every REPORTDATA preimage. */
+export const REPORTDATA_TAG = "EVDA-TDX-REPORTDATA-v1";
+
+/** The measurement registers a policy must name, each 48 bytes as 96 lowercase hex characters. */
+export const MEASUREMENT_NAMES = Object.freeze(["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"]);
+
+const HEADER_LEN = 48;
+const BODY_LEN = 584;
+const QE_REPORT_LEN = 384;
+const TEE_TDX = 0x81;
+const ATT_KEY_ECDSA_P256 = 2;
+const CERT_QE_REPORT = 6;
+const CERT_PCK_CHAIN = 5;
+const OID_SGX_EXT = "1.2.840.113741.1.13.1";
+const OID_SGX_TCB = `${OID_SGX_EXT}.2`;
+const OID_SGX_FMSPC = `${OID_SGX_EXT}.4`;
+
+const fail = (reason) => ({ ok: false, reason });
+const hex = (b) => Buffer.from(b).toString("hex");
+const sha256 = (b) => createHash("sha256").update(b).digest();
+
+// ─── the binding ─────────────────────────────────────────────────────────────────────────────────
+
+const spkiDer = (key) => {
+  if (Buffer.isBuffer(key) || key instanceof Uint8Array) return createPublicKey({ key: Buffer.from(key), format: "der", type: "spki" }).export({ type: "spki", format: "der" });
+  if (key instanceof KeyObject && key.type === "public") return key.export({ type: "spki", format: "der" });
+  return createPublicKey(key).export({ type: "spki", format: "der" });
+};
+
+/** The domain tag when REPORTDATA also binds the VM's key-wrapping key. */
+export const REPORTDATA_WRAP_TAG = "EVDA-TDX-REPORTDATA-v2";
+
+/**
+ * The 64 bytes a TD must put in REPORTDATA to bind `nonce` (32 bytes) and `tlsPublicKey` to its quote,
+ * and, when given, `wrapPublicKey` (the raw 32-byte X25519 key the VM made inside itself).
+ */
+export function reportDataFor(nonce, tlsPublicKey, wrapPublicKey) {
+  const n = Buffer.from(nonce);
+  if (n.length !== 32) throw new Error("the nonce must be 32 bytes");
+  if (wrapPublicKey == null) return createHash("sha512").update(Buffer.concat([Buffer.from(REPORTDATA_TAG, "ascii"), Buffer.from([0]), n, spkiDer(tlsPublicKey)])).digest();
+  const w = Buffer.from(wrapPublicKey);
+  if (w.length !== 32) throw new Error("the wrap key must be 32 bytes");
+  return createHash("sha512").update(Buffer.concat([Buffer.from(REPORTDATA_WRAP_TAG, "ascii"), Buffer.from([0]), n, spkiDer(tlsPublicKey), w])).digest();
+}
+
+/**
+ * The phone's record of the nonces it has issued. A nonce is good once, within `ttlMs` of issue.
+ * `take` returns null when the nonce is fresh (and spends it), or a reason in words.
+ */
+export function createNonceBook({ ttlMs = 60_000 } = {}) {
+  const issued = new Map();
+  const spent = new Set();
+  return {
+    issue(at = Date.now()) {
+      const n = randomBytes(32);
+      issued.set(hex(n), at);
+      return n;
+    },
+    take(nonce, at = Date.now()) {
+      const key = hex(nonce ?? []);
+      if (spent.has(key)) return "the nonce was already used";
+      if (!issued.has(key)) return "the nonce was not issued by this phone";
+      const issuedAt = issued.get(key);
+      issued.delete(key);
+      spent.add(key);
+      if (at - issuedAt > ttlMs || at < issuedAt) return `the nonce is stale (issued ${Math.round((at - issuedAt) / 1000)}s ago, limit ${ttlMs / 1000}s)`;
+      return null;
+    },
+  };
+}
+
+// ─── parsing ─────────────────────────────────────────────────────────────────────────────────────
+
+/** Splits a TDX quote v4 into its parts. Throws on any length that does not add up. */
+export function parseTdxQuote(raw) {
+  const q = Buffer.from(raw);
+  if (q.length < HEADER_LEN + 4) throw new Error("the quote is shorter than its header");
+  const version = q.readUInt16LE(0);
+  if (version !== 4) throw new Error(`quote version ${version} is not understood (only 4)`);
+  const header = {
+    version,
+    attestationKeyType: q.readUInt16LE(2),
+    teeType: q.readUInt32LE(4),
+    qeVendorId: hex(q.subarray(12, 28)),
+  };
+  if (q.length < HEADER_LEN + BODY_LEN + 4) throw new Error("the quote is truncated in its TD report body");
+  const b = q.subarray(HEADER_LEN, HEADER_LEN + BODY_LEN);
+  const at = (o, n) => b.subarray(o, o + n);
+  const body = {
+    teeTcbSvn: at(0, 16),
+    mrSeam: hex(at(16, 48)),
+    seamAttributes: hex(at(112, 8)),
+    tdAttributes: at(120, 8),
+    xfam: hex(at(128, 8)),
+    mrtd: hex(at(136, 48)),
+    mrConfigId: hex(at(184, 48)),
+    mrOwner: hex(at(232, 48)),
+    mrOwnerConfig: hex(at(280, 48)),
+    rtmr0: hex(at(328, 48)),
+    rtmr1: hex(at(376, 48)),
+    rtmr2: hex(at(424, 48)),
+    rtmr3: hex(at(472, 48)),
+    reportData: at(520, 64),
+  };
+  const signedLen = HEADER_LEN + BODY_LEN;
+  const sigLen = q.readUInt32LE(signedLen);
+  const s = q.subarray(signedLen + 4);
+  if (s.length < sigLen) throw new Error("the quote is truncated in its signature data");
+  if (sigLen < 64 + 64 + 6) throw new Error("the quote's signature data is too short");
+  const quoteSignature = s.subarray(0, 64);
+  const attestationKey = s.subarray(64, 128);
+  const certType = s.readUInt16LE(128);
+  const certLen = s.readUInt32LE(130);
+  if (certType !== CERT_QE_REPORT) throw new Error(`certification data type ${certType} is not a QE report (6)`);
+  const c = s.subarray(134, 134 + certLen);
+  if (c.length !== certLen || 134 + certLen > sigLen) throw new Error("the quote is truncated in its certification data");
+  if (c.length < QE_REPORT_LEN + 64 + 2) throw new Error("the QE report certification data is too short");
+  const qeReport = c.subarray(0, QE_REPORT_LEN);
+  const qeReportSignature = c.subarray(QE_REPORT_LEN, QE_REPORT_LEN + 64);
+  const authLen = c.readUInt16LE(QE_REPORT_LEN + 64);
+  let o = QE_REPORT_LEN + 66;
+  if (o + authLen + 6 > c.length) throw new Error("the quote is truncated in its QE auth data");
+  const qeAuthData = c.subarray(o, o + authLen);
+  o += authLen;
+  const innerType = c.readUInt16LE(o);
+  const innerLen = c.readUInt32LE(o + 2);
+  if (innerType !== CERT_PCK_CHAIN) throw new Error(`the QE's certification data type ${innerType} is not a PCK chain (5)`);
+  const chainBytes = c.subarray(o + 6, o + 6 + innerLen);
+  if (chainBytes.length !== innerLen) throw new Error("the quote is truncated in its PCK chain");
+  const r = qeReport;
+  return {
+    header,
+    body,
+    signed: q.subarray(0, signedLen),
+    quoteSignature,
+    attestationKey,
+    qeReport: {
+      raw: qeReport,
+      miscSelect: r.readUInt32LE(16),
+      attributes: r.subarray(48, 64),
+      mrSigner: hex(r.subarray(128, 160)),
+      isvProdId: r.readUInt16LE(256),
+      isvSvn: r.readUInt16LE(258),
+      reportData: r.subarray(320, 384),
+    },
+    qeReportSignature,
+    qeAuthData,
+    pckChainPem: chainBytes.toString("utf8").replace(/\0+$/, ""),
+  };
+}
+
+const pemCerts = (pem) => (String(pem).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).map((p) => new X509Certificate(p));
+
+const uint = (buf) => { let v = 0; for (const x of buf) v = v * 256 + x; return v; };
+
+/** The SGX TCB component SVNs, PCESVN and FMSPC from a PCK certificate's Intel extension. */
+export function pckExtensions(der) {
+  const buf = Buffer.from(der);
+  const tbs = children(buf, tlv(buf, 0))[0];
+  const extWrap = children(buf, tbs).find((c) => c.tag === 0xa3);
+  if (!extWrap) throw new Error("the PCK certificate has no extensions");
+  for (const ext of children(buf, children(buf, extWrap)[0])) {
+    const parts = children(buf, ext);
+    if (oid(buf.subarray(parts[0].start, parts[0].end)) !== OID_SGX_EXT) continue;
+    const value = parts.at(-1);
+    const raw = buf.subarray(value.start, value.end);
+    const out = { cpuSvn: [], pceSvn: null, fmspc: null };
+    for (const item of children(raw, tlv(raw, 0))) {
+      const [idNode, valNode] = children(raw, item);
+      const id = oid(raw.subarray(idNode.start, idNode.end));
+      if (id === OID_SGX_FMSPC) out.fmspc = hex(raw.subarray(valNode.start, valNode.end));
+      if (id === OID_SGX_TCB) {
+        for (const comp of children(raw, valNode)) {
+          const [cid, cval] = children(raw, comp);
+          const n = Number(oid(raw.subarray(cid.start, cid.end)).split(".").at(-1));
+          if (n >= 1 && n <= 16) out.cpuSvn[n - 1] = uint(raw.subarray(cval.start, cval.end));
+          if (n === 17) out.pceSvn = uint(raw.subarray(cval.start, cval.end));
+        }
+      }
+    }
+    if (out.cpuSvn.filter((v) => v !== undefined).length !== 16 || out.pceSvn === null || !out.fmspc) throw new Error("the PCK certificate's SGX extension is incomplete");
+    return out;
+  }
+  throw new Error("the PCK certificate has no SGX extension");
+}
+
+// ─── signatures and chains ───────────────────────────────────────────────────────────────────────
+
+const rawP256 = (xy) => createPublicKey({ key: { kty: "EC", crv: "P-256", x: xy.subarray(0, 32).toString("base64url"), y: xy.subarray(32, 64).toString("base64url") }, format: "jwk" });
+const p1363 = (data, key, sig) => verifySig("sha256", data, { key, dsaEncoding: "ieee-p1363" }, sig);
+
+function checkChainToRoot(certs, root, at, what) {
+  const all = [...certs, root];
+  for (let i = 0; i < all.length; i++) {
+    const issuer = all[Math.min(i + 1, all.length - 1)];
+    if (!all[i].checkIssued(issuer) || !all[i].verify(issuer.publicKey)) return `the ${what} chain does not reach the pinned Intel root (breaks at ${all[i].subject.split("\n").find((l) => l.startsWith("CN=")) ?? "a certificate"})`;
+    if (at < new Date(all[i].validFrom) || at > new Date(all[i].validTo)) return `a certificate in the ${what} chain is not valid at ${at.toISOString()}`;
+    if (i > 0 && !all[i].ca) return `the ${what} chain has a non-CA certificate as an issuer`;
+  }
+  return null;
+}
+
+/** Splits an Intel PCS response into the exact signed bytes, the parsed document and the signature. */
+function signedDocument(text, field) {
+  const t = String(text ?? "").replace(/\s+$/, "");
+  const m = new RegExp(`^\\{"${field}":([\\s\\S]+),"signature":"([0-9a-fA-F]{128})"\\}$`).exec(t);
+  if (!m) return null;
+  return { body: Buffer.from(m[1], "utf8"), doc: JSON.parse(m[1]), signature: Buffer.from(m[2], "hex") };
+}
+
+function checkCollateralDoc({ text, chainPem, field, root, at, what }) {
+  const d = signedDocument(text, field);
+  if (!d) return { error: `the ${what} is not an Intel PCS response` };
+  const certs = pemCerts(chainPem);
+  if (certs.length === 0) return { error: `the ${what} has no issuer chain` };
+  const signer = certs[0];
+  const chainProblem = checkChainToRoot(certs.filter((c) => !c.raw.equals(root.raw)), root, at, what);
+  if (chainProblem) return { error: chainProblem };
+  if (!p1363(d.body, signer.publicKey, d.signature)) return { error: `the ${what} signature does not verify under Intel's TCB signing key` };
+  const issue = Date.parse(d.doc.issueDate);
+  const next = Date.parse(d.doc.nextUpdate);
+  if (!(issue <= at.getTime() && at.getTime() <= next)) return { error: `the ${what} is not current at ${at.toISOString()} (valid ${d.doc.issueDate} to ${d.doc.nextUpdate})` };
+  return { doc: d.doc };
+}
+
+const masked = (value, mask) => Buffer.from(value.map((b, i) => b & mask[i]));
+
+// Intel's TCB level algorithm (the PCS TDX TCB info spec, as go-tdx-guest implements it): the first
+// level, in Intel's descending order, that the PCK's SGX SVNs, its PCESVN and the TD's TEE_TCB_SVN all
+// meet. When TEE_TCB_SVN[1] names a TDX module version, indexes 0 and 1 are judged instead by the
+// matching TDX module identity.
+function matchTcbLevel(tcbInfo, pck, teeTcbSvn) {
+  const from = teeTcbSvn[1] > 0 ? 2 : 0;
+  for (const level of tcbInfo.tcbLevels ?? []) {
+    const sgx = level.tcb?.sgxtcbcomponents ?? [];
+    const tdx = level.tcb?.tdxtcbcomponents ?? [];
+    if (sgx.length !== 16 || tdx.length !== 16) continue;
+    if (!pck.cpuSvn.every((v, i) => v >= sgx[i].svn)) continue;
+    if (pck.pceSvn < level.tcb.pcesvn) continue;
+    if (!teeTcbSvn.every((v, i) => i < from || v >= tdx[i].svn)) continue;
+    return level;
+  }
+  return null;
+}
+
+function matchModuleLevel(tcbInfo, teeTcbSvn) {
+  const id = `TDX_${teeTcbSvn[1].toString(16).padStart(2, "0").toUpperCase()}`;
+  const identity = (tcbInfo.tdxModuleIdentities ?? []).find((m) => String(m.id).toUpperCase() === id);
+  if (!identity) return { error: `Intel's TCB info has no identity for TDX module ${id}` };
+  const level = (identity.tcbLevels ?? []).find((l) => teeTcbSvn[0] >= l.tcb?.isvsvn);
+  if (!level) return { error: `TDX module ${id} at SVN ${teeTcbSvn[0]} matches no level Intel lists` };
+  return { id, level };
+}
+
+/**
+ * Verifies a TDX quote's signatures, its chain to the pinned Intel root, the QE's identity and the
+ * platform's TCB level against Intel's signed collateral. Policy on the TD itself (debug, measurements,
+ * nonce, TLS binding) is verifyTdxAttestation's.
+ *
+ * collateral: { tcbInfo, tcbInfoIssuerChain, qeIdentity, qeIdentityIssuerChain } as Intel PCS serves them.
+ * minTcb: { statuses: ["UpToDate", ...], tcbEvaluationDataNumber } (statuses defaults to UpToDate only).
+ */
+export function verifyTdxQuote({ quote, collateral, minTcb, now, trust = TDX_TRUST } = {}) {
+  try {
+    return checkQuote({ quote, collateral, minTcb, now, trust });
+  } catch (err) {
+    return fail(`the quote could not be read: ${err.message}`);
+  }
+}
+
+function checkQuote({ quote, collateral, minTcb, now, trust }) {
+  if (!quote) return fail("there is no quote");
+  if (now === undefined) return fail("no time was given to check certificates and collateral against");
+  if (!collateral?.tcbInfo || !collateral?.qeIdentity) return fail("no Intel collateral was given, so the TCB cannot be judged");
+  if (!minTcb || !Number.isSafeInteger(minTcb.tcbEvaluationDataNumber)) return fail("no minimum TCB was named");
+  const at = new Date(now);
+  const q = parseTdxQuote(quote);
+
+  // 1. What kind of quote this is.
+  if (q.header.teeType !== TEE_TDX) return fail(`the quote is for TEE type 0x${q.header.teeType.toString(16)}, not TDX`);
+  if (q.header.attestationKeyType !== ATT_KEY_ECDSA_P256) return fail(`attestation key type ${q.header.attestationKeyType} is not ECDSA P-256`);
+  if (q.header.qeVendorId !== trust.intel.qeVendorId) return fail("the quote is not from Intel's quoting enclave");
+
+  // 2. The attestation key signed the header and the TD report.
+  if (!p1363(q.signed, rawP256(q.attestationKey), q.quoteSignature)) return fail("the quote signature does not verify under its attestation key");
+
+  // 3. The PCK leaf signed the QE report, and chains to the pinned Intel root.
+  const root = new X509Certificate(Buffer.from(trust.intel.rootDer, "base64"));
+  const certs = pemCerts(q.pckChainPem);
+  if (certs.length < 2) return fail("the quote's PCK chain is incomplete");
+  const chain = certs.filter((c) => !c.raw.equals(root.raw));
+  if (chain.length !== 2) return fail("the quote's PCK chain does not end at the pinned Intel root");
+  const chainProblem = checkChainToRoot(chain, root, at, "PCK");
+  if (chainProblem) return fail(chainProblem);
+  const pck = chain[0];
+  if (pck.ca) return fail("the PCK certificate is a CA");
+  if (!p1363(q.qeReport.raw, pck.publicKey, q.qeReportSignature)) return fail("the QE report signature does not verify under the PCK certificate");
+
+  // 4. The QE vouched for this attestation key.
+  const want = Buffer.concat([sha256(Buffer.concat([q.attestationKey, q.qeAuthData])), Buffer.alloc(32)]);
+  if (!want.equals(q.qeReport.reportData)) return fail("the QE report does not bind the attestation key that signed the quote");
+
+  // 5. Intel's collateral: the QE is Intel's, and the platform's TCB level is one the policy allows.
+  const qe = checkCollateralDoc({ text: collateral.qeIdentity, chainPem: collateral.qeIdentityIssuerChain, field: "enclaveIdentity", root, at, what: "QE identity" });
+  if (qe.error) return fail(qe.error);
+  const id = qe.doc;
+  if (id.id !== "TD_QE") return fail(`the QE identity is for ${id.id}, not TD_QE`);
+  if ((q.qeReport.miscSelect & parseInt(id.miscselectMask, 16)) !== parseInt(id.miscselect, 16)) return fail("the QE's MISCSELECT does not match Intel's QE identity");
+  if (!masked([...q.qeReport.attributes], Buffer.from(id.attributesMask, "hex")).equals(Buffer.from(id.attributes, "hex"))) return fail("the QE's attributes do not match Intel's QE identity");
+  if (q.qeReport.mrSigner !== id.mrsigner.toLowerCase()) return fail("the QE was not signed by Intel (MRSIGNER differs)");
+  if (q.qeReport.isvProdId !== id.isvprodid) return fail("the QE's product id does not match Intel's QE identity");
+  const qeLevel = (id.tcbLevels ?? []).find((l) => l.tcb?.isvsvn <= q.qeReport.isvSvn);
+  if (qeLevel?.tcbStatus !== "UpToDate") return fail(`the QE's TCB is ${qeLevel?.tcbStatus ?? "not in Intel's list"}`);
+
+  const ti = checkCollateralDoc({ text: collateral.tcbInfo, chainPem: collateral.tcbInfoIssuerChain, field: "tcbInfo", root, at, what: "TCB info" });
+  if (ti.error) return fail(ti.error);
+  const tcbInfo = ti.doc;
+  if (tcbInfo.id !== "TDX" || tcbInfo.version !== 3) return fail("the TCB info is not TDX TCB info version 3");
+  const ext = pckExtensions(pck.raw);
+  if (tcbInfo.fmspc.toLowerCase() !== ext.fmspc) return fail(`the TCB info is for FMSPC ${tcbInfo.fmspc}, and this platform is ${ext.fmspc}`);
+  const teeTcbSvn = [...q.body.teeTcbSvn];
+  if (tcbInfo.tcbEvaluationDataNumber < minTcb.tcbEvaluationDataNumber) return fail(`Intel's TCB evaluation ${tcbInfo.tcbEvaluationDataNumber} is older than the minimum ${minTcb.tcbEvaluationDataNumber}`);
+  const level = matchTcbLevel(tcbInfo, ext, teeTcbSvn);
+  if (!level) return fail("the platform matches no TCB level in Intel's TCB info, so it is below every level Intel supports");
+  const statuses = minTcb.statuses ?? ["UpToDate"];
+  if (!statuses.includes(level.tcbStatus)) return fail(`the platform's TCB is ${level.tcbStatus} (${level.tcbDate}), below the minimum (${statuses.join(" or ")})`);
+  let module = null;
+  if (teeTcbSvn[1] > 0) {
+    const m = matchModuleLevel(tcbInfo, teeTcbSvn);
+    if (m.error) return fail(m.error);
+    if (!statuses.includes(m.level.tcbStatus)) return fail(`TDX module ${m.id} is ${m.level.tcbStatus}, below the minimum (${statuses.join(" or ")})`);
+    module = { id: m.id, status: m.level.tcbStatus };
+  }
+
+  return {
+    ok: true,
+    body: q.body,
+    tcb: { status: level.tcbStatus, date: level.tcbDate, evaluationDataNumber: tcbInfo.tcbEvaluationDataNumber, fmspc: ext.fmspc, module, advisoryIds: level.advisoryIDs ?? [] },
+  };
+}
+
+/**
+ * The phone's whole check before it sends a hosted EVÐA anything. Returns { ok: true, measurements,
+ * tcb, tlsPublicKeySha256 } (the hash is the key the phone pins), or { ok: false, reason }.
+ *
+ * nonce: the 32 bytes the phone sent; nonces: the createNonceBook that issued it (spent here, pass or fail).
+ * tlsPublicKey: the TLS server key of this connection (KeyObject, PEM, or SPKI DER).
+ * expected: { mrtd, rtmr0, rtmr1, rtmr2, rtmr3 } as hex. Every one must be named.
+ * wrapPublicKey: the VM's key-wrapping key as the host named it (32 raw bytes), or absent. When given,
+ * the quote must bind it too, and the result names it.
+ */
+export function verifyTdxAttestation({ quote, nonce, nonces, tlsPublicKey, wrapPublicKey, expected, minTcb, collateral, now, trust = TDX_TRUST } = {}) {
+  try {
+    if (!nonces?.take) return fail("no nonce book was given, so freshness cannot be checked");
+    const at = now === undefined ? undefined : new Date(now).getTime();
+    const stale = nonces.take(nonce, at);
+    if (stale) return fail(stale);
+    if (!tlsPublicKey) return fail("no TLS key was given, so the quote cannot be bound to this connection");
+    if (!expected || MEASUREMENT_NAMES.some((n) => !/^[0-9a-f]{96}$/.test(expected[n] ?? ""))) return fail(`the expected measurements must name ${MEASUREMENT_NAMES.join(", ")} as 96 hex characters each`);
+
+    const r = verifyTdxQuote({ quote, collateral, minTcb, now, trust });
+    if (!r.ok) return r;
+
+    // 6. Debug off. TDATTRIBUTES bit 0 is TUD.DEBUG: a debug TD lets the host read its memory.
+    if (r.body.tdAttributes[0] & 1) return fail("the TD runs with debug on, so its host can read its memory");
+
+    // 7. The code is the code expected.
+    for (const n of MEASUREMENT_NAMES) if (r.body[n] !== expected[n]) return fail(`${n.toUpperCase()} is ${r.body[n].slice(0, 16)}..., not the expected ${expected[n].slice(0, 16)}...`);
+
+    // 9 and 10. The quote is for this nonce, this TLS key and, when named, this wrap key.
+    const want = reportDataFor(nonce, tlsPublicKey, wrapPublicKey);
+    if (!timingSafeEqual(want, r.body.reportData)) return fail(wrapPublicKey == null ? "REPORTDATA does not bind this nonce and this TLS key" : "REPORTDATA does not bind this nonce, this TLS key and this wrap key");
+
+    const measurements = Object.fromEntries(MEASUREMENT_NAMES.map((n) => [n, r.body[n]]));
+    const out = { ok: true, measurements, tcb: r.tcb, tlsPublicKeySha256: sha256(spkiDer(tlsPublicKey)).toString("hex") };
+    if (wrapPublicKey != null) out.wrapPublicKey = Buffer.from(wrapPublicKey);
+    return out;
+  } catch (err) {
+    return fail(`the attestation could not be checked: ${err.message}`);
+  }
+}

package/lib/tdx-trust.json

@@ -0,0 +1,10 @@
+{
+  "_comment": "The roots a phone trusts for an Intel TDX quote (HQ-2083). Fetched 2026-10-18 from Intel and checked equal to the root go-tdx-guest pins (verify/trusted_root.pem).",
+  "intel": {
+    "source": "https://certificates.trustedservices.intel.com/Intel_SGX_Provisioning_Certification_RootCA.cer",
+    "subject": "CN=Intel SGX Root CA, O=Intel Corporation, L=Santa Clara, ST=CA, C=US",
+    "sha256": "44a0196b2b99f889b8e149e95b807a350e7424964399e885a7cbb8ccfab674d3",
+    "rootDer": "MIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIwaDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi71OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOBuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SVUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYIKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwgAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=",
+    "qeVendorId": "939a7233f79c4ca9940a0db3957f0607"
+  }
+}