routex-settlement 0.1.3 → 0.1.5

package/index.d.ts

@@ -3,8 +3,9 @@ export declare class KeySettlement {
     private _onErrorResponse;
     private _onRequestError;
     private _secretKey;
-    private _requirements;
-    private _yaxiSigningKeys;
+    private _publicKey;
+    private _requirements?;
+    private _yaxiSigningKeys?;
     private _serverKey?;
     private _settlementPromise?;
     private _measurement?;
@@ -13,12 +14,11 @@ export declare class KeySettlement {
     measurement(): Uint8Array | undefined;
     private _getServerKey;
     getBase64SessionId(settlementHeaders?: HeadersInit): Promise<string>;
-    seal(plaintext: Uint8Array, settlementHeaders?: HeadersInit): Promise<Uint8Array>;
-    unseal(ciphertext: Uint8Array): Uint8Array;
-    private _verifyAttestation;
-    private _verifyTcbVersion;
-    private _verifyReport;
-    private _verifyVcekChain;
+    seal(plaintext: Uint8Array, settlementHeaders?: HeadersInit): Promise<Uint8Array<ArrayBuffer>>;
+    unseal(ciphertext: Uint8Array): Uint8Array<ArrayBuffer>;
 }
-export declare function binaryStringToBytes(binaryString: string): Uint8Array<ArrayBuffer>;
+export declare function binaryStringToBytes(binaryString: string): Uint8Array;
 export declare function bytesToBinaryString(bytes: Uint8Array): string;
+export declare const _testing: {
+    [Key: string]: unknown;
+};

package/index.js

@@ -1,37 +1,59 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
+import { chacha20poly1305 } from '@noble/ciphers/chacha.js';
+import { blake2b } from '@noble/hashes/blake2.js';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { createHasher } from '@noble/hashes/utils.js';
+import { equalBytes } from '@noble/curves/utils.js';
+import { x25519, ed25519 } from '@noble/curves/ed25519.js';
+import { p384 } from '@noble/curves/nist.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { AsnConvert } from '@peculiar/asn1-schema';
+import { SubjectPublicKeyInfo } from '@peculiar/asn1-x509';
+import * as x509 from '@peculiar/x509';
+
+/******************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+/* global Reflect, Promise, SuppressedError, Symbol, Iterator */
+
+
+function __awaiter(thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+}
+
+typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
-import { chacha20poly1305 } from "@noble/ciphers/chacha";
-import { bytesToUtf8 } from "@noble/ciphers/utils";
-import { equalBytes } from "@noble/curves/utils";
-import { ed25519, x25519 } from "@noble/curves/ed25519";
-import { blake2b } from "@noble/hashes/blake2";
-import { p384 } from "@noble/curves/nist";
-import { hkdf } from "@noble/hashes/hkdf";
-import { createHasher } from "@noble/hashes/utils";
-import { sha256 } from "@noble/hashes/sha2";
-import * as x509 from "@peculiar/x509";
-import { AsnConvert } from "@peculiar/asn1-schema";
-import { SubjectPublicKeyInfo } from "@peculiar/asn1-x509";
+
 const REQUIREMENTS = {
     Genoa: {
-        minCommittedVersion: [0x1, 0x37, 0x26],
-        minCommittedTcbSnp: 0x16,
+        minCommittedVersion: [0x1, 0x37, 0x31],
+        minCommittedTcbSnp: 0x1b,
     },
     Milan: {
-        minCommittedVersion: [0x1, 0x37, 0x16],
-        minCommittedTcbSnp: 0x17,
+        minCommittedVersion: [0x1, 0x37, 0x23],
+        minCommittedTcbSnp: 0x1b,
     },
-    // for Turin: SB-3019 doesn't list a TCB[SNP] version in the mitigation, only firmware version
     Turin: {
-        minCommittedVersion: [0x1, 0x37, 0x3b],
-        minCommittedTcbSnp: 0,
+        minCommittedVersion: [0x1, 0x37, 0x41],
+        minCommittedTcbSnp: 0x04,
     },
 };
 const YAXI_SIGNING_KEYS = {
@@ -288,17 +310,332 @@ zpacMwFusA==
 `),
     ],
 });
-export class KeySettlement {
+function generateKey() {
+    const secret = x25519.utils.randomSecretKey();
+    return { secret, public: x25519.getPublicKey(secret) };
+}
+function seal(serverPublicKey, plaintext) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const tagLength = 16;
+        const ephemeralSecretKey = x25519.utils.randomSecretKey();
+        const ephemeralPublicKey = x25519.getPublicKey(ephemeralSecretKey);
+        const nonce = _getSealNonce(ephemeralPublicKey, serverPublicKey);
+        const info = _getInfo(ephemeralPublicKey, serverPublicKey);
+        const cipher = _createCipher(serverPublicKey, ephemeralSecretKey, info, nonce);
+        const ciphertext = new Uint8Array(ephemeralPublicKey.length + tagLength + plaintext.length);
+        ciphertext.set(ephemeralPublicKey);
+        ciphertext.set(cipher.encrypt(plaintext), ephemeralPublicKey.length);
+        return ciphertext;
+    });
+}
+function unseal(clientKey, ciphertext) {
+    const ephemeralPublicKey = ciphertext.subarray(0, 32);
+    const publicKey = x25519.getPublicKey(clientKey.secret);
+    const nonce = _getSealNonce(ephemeralPublicKey, publicKey);
+    const info = _getInfo(ephemeralPublicKey, publicKey);
+    const cipher = _createCipher(ephemeralPublicKey, clientKey.secret, info, nonce);
+    return cipher.decrypt(ciphertext.subarray(32), new Uint8Array(ciphertext.length - 32 - chacha20poly1305.tagLength));
+}
+function verifyAttestation(response, requirements, signingKeys) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const attestationReport = binaryStringToBytes$1(atob(response.attestationReport));
+        yield _verifyReport(attestationReport, response.vcek, requirements !== null && requirements !== void 0 ? requirements : REQUIREMENTS);
+        if (!equalBytes(attestationReport.slice(REPORT_OFFSETS.reportData, REPORT_OFFSETS.reportData + 32), sha256(binaryStringToBytes$1(atob(response.chachaBox))))) {
+            throw new Error("Data in attestation report doesn't match chacha box");
+        }
+        const encoder = new TextEncoder();
+        const launchMeasurementInSystemVersion = binaryStringToBytes$1(atob(response.systemVersion.launchMeasurement));
+        const input = new Uint8Array([
+            ...encoder.encode(response.systemVersion.kind),
+            ...encoder.encode(response.systemVersion.generation.toString()),
+            ...encoder.encode(
+            // clerk-report used to use Z for serialization, but not for the signature input
+            response.systemVersion.createdAt.replace("Z", "+00:00")),
+            ...encoder.encode(response.systemVersion.ref),
+            ...launchMeasurementInSystemVersion,
+        ]);
+        const key = (signingKeys !== null && signingKeys !== void 0 ? signingKeys : YAXI_SIGNING_KEYS)[response.systemVersion.signature.keyId];
+        if (key == null) {
+            throw new Error("The system version's signature key is unknown");
+        }
+        if (!ed25519.verify(binaryStringToBytes$1(atob(response.systemVersion.signature.value)), input, key)) {
+            throw new Error("Verification failed: Invalid system version signature");
+        }
+        if (!equalBytes(attestationReport.slice(REPORT_OFFSETS.measurement, REPORT_OFFSETS.measurement + 48), launchMeasurementInSystemVersion)) {
+            throw new Error("Reported measurement doesn't match expected measurement");
+        }
+        return launchMeasurementInSystemVersion;
+    });
+}
+function _verifyTcbVersion(attestationReport, vcekTcb) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const versionBytes = attestationReport.slice(0, 4);
+        const version = new DataView(versionBytes.buffer).getInt32(0, true);
+        let turinLike;
+        switch (version) {
+            case 0:
+            case 1:
+                throw new Error("Unsupported Attestation Report Version");
+            case 2: {
+                const chipId = attestationReport.slice(REPORT_OFFSETS.chipId, 64);
+                if (equalBytes(chipId, new Uint8Array(64))) {
+                    throw new Error("Could not derive CPU family: MASK_CHIP_ID enabled");
+                }
+                turinLike = equalBytes(chipId.slice(8), new Uint8Array(56));
+                break;
+            }
+            default: // from version 3 onwards CPUID_FAM_ID field should exist
+                turinLike = attestationReport[REPORT_OFFSETS.cpuIdFamily] == 0x1a;
+        }
+        const reportedTcb = attestationReport.slice(REPORT_OFFSETS.reportedTcb, REPORT_OFFSETS.reportedTcb + 8);
+        let tcb;
+        if (turinLike) {
+            tcb = {
+                microcode: reportedTcb[7],
+                snp: reportedTcb[3],
+                tee: reportedTcb[2],
+                bootloader: reportedTcb[1],
+                fmc: reportedTcb[0],
+            };
+        }
+        else {
+            tcb = {
+                microcode: reportedTcb[7],
+                snp: reportedTcb[6],
+                tee: reportedTcb[1],
+                bootloader: reportedTcb[0],
+                fmc: 0,
+            };
+        }
+        if (!(tcb.microcode === vcekTcb.microcode &&
+            tcb.snp === vcekTcb.snp &&
+            tcb.tee === vcekTcb.tee &&
+            tcb.bootloader === vcekTcb.bootloader &&
+            tcb.fmc === vcekTcb.fmc)) {
+            throw new Error("Verification failed: REPORTED_TCB doesn't match with VCEK's TCB_VERSION");
+        }
+    });
+}
+function _verifyReport(attestationReport, vcekChain, requirementsMap) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (attestationReport.length != 1184) {
+            throw new Error(`Attestation report has unexpected length: ${attestationReport.length}`);
+        }
+        const { product, publicKey, vcekTcb } = yield _verifyVcekChain(vcekChain, requirementsMap);
+        const requirements = requirementsMap[product];
+        if (!equalBytes(attestationReport.slice(REPORT_OFFSETS.signatureR + 48, REPORT_OFFSETS.signatureR + 72), new Uint8Array(24)) ||
+            !equalBytes(attestationReport.slice(REPORT_OFFSETS.signatureS + 48, REPORT_OFFSETS.signatureS + 72), new Uint8Array(24))) {
+            throw new Error("Unexpected signature bits");
+        }
+        const sig = new Uint8Array(96);
+        sig.set(attestationReport
+            .slice(REPORT_OFFSETS.signatureR, REPORT_OFFSETS.signatureR + 48)
+            // Change endianness
+            .reverse(), 0);
+        sig.set(attestationReport
+            .slice(REPORT_OFFSETS.signatureS, REPORT_OFFSETS.signatureS + 48)
+            // Change endianness
+            .reverse(), 48);
+        let valid;
+        try {
+            valid = p384.verify(sig, attestationReport.slice(0, 672), new Uint8Array(publicKey), { lowS: false });
+        }
+        catch (_a) {
+            valid = false;
+        }
+        if (!valid) {
+            throw new Error("Verification failed: Invalid attestation report signature");
+        }
+        if ((attestationReport[REPORT_OFFSETS.platInfo] &
+            (1 << PLATFORM_INFO_BITS.aliasCheckComplete)) ===
+            0) {
+            throw new Error("Verification failed: Alias check complete is false");
+        }
+        if (attestationReport[REPORT_OFFSETS.committedMajor] <
+            requirements.minCommittedVersion[0] ||
+            attestationReport[REPORT_OFFSETS.committedMinor] <
+                requirements.minCommittedVersion[1] ||
+            attestationReport[REPORT_OFFSETS.committedBuild] <
+                requirements.minCommittedVersion[2]) {
+            throw new Error("Verification failed: Firmware version too small");
+        }
+        if (attestationReport[REPORT_OFFSETS.committedTcbSnp] <
+            requirements.minCommittedTcbSnp) {
+            throw new Error("Verification failed: SNP patch level too small");
+        }
+        const cpuModel = attestationReport[REPORT_OFFSETS.cpuIdModel];
+        const cpuStep = attestationReport[REPORT_OFFSETS.cpuIdStep];
+        let requiredMicrocode;
+        switch (product) {
+            case "Milan": {
+                if (cpuModel === 1 && cpuStep === 1) {
+                    // Milan
+                    requiredMicrocode = 0xde;
+                }
+                else if (cpuModel === 1 && cpuStep === 2) {
+                    // Milan-X
+                    requiredMicrocode = 0x45;
+                }
+                break;
+            }
+            case "Genoa": {
+                if (cpuModel === 0x11) {
+                    if (cpuStep === 1) {
+                        // Genoa
+                        requiredMicrocode = 0x56;
+                    }
+                    else if (cpuStep === 2) {
+                        // Genoa-X
+                        requiredMicrocode = 0x51;
+                    }
+                }
+                else if (cpuModel === 0xa0 && cpuStep === 2) {
+                    // Bergamo/Siena
+                    requiredMicrocode = 0x1b;
+                }
+                break;
+            }
+            case "Turin":
+                if (cpuModel === 2 && cpuStep === 1) {
+                    // Turin Classic
+                    requiredMicrocode = 0x50;
+                }
+                else if (cpuModel === 0x11 && cpuStep === 0) {
+                    // Turin Dense
+                    requiredMicrocode = 0x4d;
+                }
+                else if (cpuModel > 2 ||
+                    (cpuModel === 2 && cpuStep > 1) ||
+                    (cpuModel === 0x11 && cpuStep > 0)) {
+                    // Accept any newer models/steppings for Turin
+                    requiredMicrocode = 0;
+                }
+        }
+        if (requiredMicrocode === undefined) {
+            throw new Error("Verification failed: Report doesn't match any known CPU family");
+        }
+        const reportedMicrocode = attestationReport.slice(REPORT_OFFSETS.reportedTcb, REPORT_OFFSETS.reportedTcb + 8)[7];
+        if (reportedMicrocode < requiredMicrocode) {
+            throw new Error("Verification failed: Reported microcode version too small");
+        }
+        yield _verifyTcbVersion(attestationReport, vcekTcb);
+    });
+}
+function _verifyVcekChain(vcek, requirements) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let cert;
+        try {
+            cert = new x509.X509Certificate(vcek);
+        }
+        catch (e) {
+            throw new Error(`Invalid VCEK: ${e}\n\nVCEK: ${vcek}`);
+        }
+        const chain = yield ROOT_STORE.build(cert);
+        if (chain.length != 3) {
+            throw new Error(`Certificate chain verification failed\n\nChain: ${chain}`);
+        }
+        const find_extension = (oid, type) => {
+            const ext = chain[0].extensions.find((ext) => ext.type == oid);
+            if (!ext) {
+                throw new Error(`Could not find ${type}\n\nExtensions: ${chain[0].extensions}`);
+            }
+            return new Uint8Array(ext.value);
+        };
+        const productIA5String = find_extension("1.3.6.1.4.1.3704.1.2", "product name");
+        if (productIA5String[0] !== 0x16) {
+            throw new Error(`Unexpected product extension: ${productIA5String}`);
+        }
+        const product = String.fromCharCode(...productIA5String.slice(2)).split("-", 1)[0];
+        if (!Object.prototype.hasOwnProperty.call(requirements, product)) {
+            throw new Error(`Unexpected product: ${product}`);
+        }
+        const subjectPublicKeyInfo = AsnConvert.parse(chain[0].publicKey.rawData, SubjectPublicKeyInfo);
+        const bootloader = find_extension("1.3.6.1.4.1.3704.1.3.1", "bootloader version")[2];
+        const tee = find_extension("1.3.6.1.4.1.3704.1.3.2", "TEE")[2];
+        const snp = find_extension("1.3.6.1.4.1.3704.1.3.3", "SNP version")[2];
+        const microcode = find_extension("1.3.6.1.4.1.3704.1.3.8", "microcode")[2];
+        const tcb = {
+            bootloader: bootloader,
+            tee: tee,
+            snp: snp,
+            microcode: microcode,
+            fmc: 0,
+        };
+        const fmc = chain[0].extensions.find((ext) => ext.type == "1.3.6.1.4.1.3704.1.3.9");
+        if (fmc) {
+            tcb.fmc = new Uint8Array(fmc.value)[2];
+        }
+        return {
+            product: product,
+            publicKey: new Uint8Array(subjectPublicKeyInfo.subjectPublicKey),
+            vcekTcb: tcb,
+        };
+    });
+}
+function binaryStringToBytes$1(binaryString) {
+    return Uint8Array.from(binaryString, (c) => c.charCodeAt(0));
+}
+function _createCipher(publicKey, secretKey, info, nonce) {
+    const sharedSecret = x25519.getSharedSecret(secretKey, publicKey);
+    const key = hkdf(createHasher(() => blake2b.create({ dkLen: 64 })), sharedSecret, Uint8Array.from([]), info, 32);
+    return chacha20poly1305(key, nonce);
+}
+function _getInfo(ephemeralPublicKey, recipientPublicKey) {
+    const info = new Uint8Array(ephemeralPublicKey.length + recipientPublicKey.length);
+    info.set(ephemeralPublicKey);
+    info.set(recipientPublicKey, ephemeralPublicKey.length);
+    return info;
+}
+function _getSealNonce(ephemeralPublicKey, recipientPublicKey) {
+    return blake2b
+        .create({ dkLen: 12 })
+        .update(ephemeralPublicKey)
+        .update(recipientPublicKey)
+        .digest();
+}
+const REPORT_OFFSETS = {
+    platInfo: 64,
+    reportData: 80,
+    measurement: 144,
+    reportedTcb: 384,
+    cpuIdFamily: 392,
+    cpuIdModel: 393,
+    cpuIdStep: 394,
+    chipId: 416,
+    committedTcbSnp: 486,
+    committedBuild: 492,
+    committedMinor: 493,
+    committedMajor: 494,
+    signatureR: 672,
+    signatureS: 744,
+};
+const PLATFORM_INFO_BITS = {
+    aliasCheckComplete: 5,
+};
+function bytesToUtf8(bytes) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return new TextDecoder().decode(bytes);
+    });
+}
+const _testing$1 = {};
+if (typeof process !== "undefined" && process.env.NODE_ENV === "test") {
+    _testing$1.REQUIREMENTS = REQUIREMENTS;
+    _testing$1.YAXI_SIGNING_KEYS = YAXI_SIGNING_KEYS;
+    _testing$1.verifyReport = _verifyReport;
+    _testing$1.verifyTcbVersion = _verifyTcbVersion;
+}
+
+class KeySettlement {
     constructor(url, onErrorResponse, onRequestError) {
-        this._requirements = REQUIREMENTS;
-        this._yaxiSigningKeys = YAXI_SIGNING_KEYS;
         this._url = url;
         this._onErrorResponse = onErrorResponse;
         this._onRequestError =
             onRequestError !== null && onRequestError !== void 0 ? onRequestError : ((e) => {
                 throw e;
             });
-        this._secretKey = x25519.utils.randomSecretKey();
+        const { secret, public: pub } = generateKey();
+        this._secretKey = secret;
+        this._publicKey = pub;
     }
     _settle(headers) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -306,7 +643,7 @@ export class KeySettlement {
                 method: "POST",
                 headers: headers,
                 body: JSON.stringify({
-                    publicKey: btoa(bytesToBinaryString(x25519.getPublicKey(this._secretKey))),
+                    publicKey: btoa(bytesToBinaryString(this._publicKey)),
                 }),
             })
                 .catch(this._onRequestError)
@@ -317,8 +654,8 @@ export class KeySettlement {
                 throw yield this._onErrorResponse(response);
             }
             const responseData = yield response.json();
-            const measurement = yield this._verifyAttestation(responseData);
-            const settlementBoxMessage = JSON.parse(bytesToUtf8(this.unseal(binaryStringToBytes(atob(responseData.chachaBox)))));
+            const measurement = yield verifyAttestation(responseData, this._requirements, this._yaxiSigningKeys);
+            const settlementBoxMessage = JSON.parse(yield bytesToUtf8(this.unseal(binaryStringToBytes(atob(responseData.chachaBox)))));
             this._serverKey = {
                 publicKey: binaryStringToBytes(atob(settlementBoxMessage.publicKey)),
                 base64SessionId: settlementBoxMessage.sessionId,
@@ -349,246 +686,19 @@ export class KeySettlement {
         return __awaiter(this, arguments, void 0, function* (plaintext, settlementHeaders = {}) {
             const serverPublicKey = (yield this._getServerKey(settlementHeaders))
                 .publicKey;
-            const tagLength = 16;
-            const ephemeralSecretKey = x25519.utils.randomSecretKey();
-            const ephemeralPublicKey = x25519.getPublicKey(ephemeralSecretKey);
-            const nonce = _getSealNonce(ephemeralPublicKey, serverPublicKey);
-            const info = _getInfo(ephemeralPublicKey, serverPublicKey);
-            const cipher = _createCipher(serverPublicKey, ephemeralSecretKey, info, nonce);
-            const ciphertext = new Uint8Array(ephemeralPublicKey.length + tagLength + plaintext.length);
-            ciphertext.set(ephemeralPublicKey);
-            ciphertext.set(cipher.encrypt(plaintext), ephemeralPublicKey.length);
-            return ciphertext;
+            return yield seal(serverPublicKey, plaintext);
         });
     }
     unseal(ciphertext) {
-        const ephemeralPublicKey = ciphertext.subarray(0, 32);
-        const publicKey = x25519.getPublicKey(this._secretKey);
-        const nonce = _getSealNonce(ephemeralPublicKey, publicKey);
-        const info = _getInfo(ephemeralPublicKey, publicKey);
-        const cipher = _createCipher(ephemeralPublicKey, this._secretKey, info, nonce);
-        return cipher.decrypt(ciphertext.subarray(32));
-    }
-    _verifyAttestation(response) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const attestationReport = binaryStringToBytes(atob(response.attestationReport));
-            yield this._verifyReport(attestationReport, response.vcek);
-            if (!equalBytes(attestationReport.slice(REPORT_OFFSETS.reportData, REPORT_OFFSETS.reportData + 32), sha256(binaryStringToBytes(atob(response.chachaBox))))) {
-                throw new Error("Data in attestation report doesn't match chacha box");
-            }
-            const encoder = new TextEncoder();
-            const launchMeasurementInSystemVersion = binaryStringToBytes(atob(response.systemVersion.launchMeasurement));
-            const input = new Uint8Array([
-                ...encoder.encode(response.systemVersion.kind),
-                ...encoder.encode(response.systemVersion.generation.toString()),
-                ...encoder.encode(
-                // clerk-report used to use Z for serialization, but not for the signature input
-                response.systemVersion.createdAt.replace("Z", "+00:00")),
-                ...encoder.encode(response.systemVersion.ref),
-                ...launchMeasurementInSystemVersion,
-            ]);
-            const key = this._yaxiSigningKeys[response.systemVersion.signature.keyId];
-            if (key == null) {
-                throw new Error("The system version's signature key is unknown");
-            }
-            if (!ed25519.verify(binaryStringToBytes(atob(response.systemVersion.signature.value)), input, key)) {
-                throw new Error("Verification failed: Invalid system version signature");
-            }
-            if (!equalBytes(attestationReport.slice(REPORT_OFFSETS.measurement, REPORT_OFFSETS.measurement + 48), launchMeasurementInSystemVersion)) {
-                throw new Error("Reported measurement doesn't match expected measurement");
-            }
-            return launchMeasurementInSystemVersion;
-        });
-    }
-    _verifyTcbVersion(attestationReport, vcekTcb) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const versionBytes = attestationReport.slice(0, 4);
-            const version = new DataView(versionBytes.buffer).getInt32(0, true);
-            let turinLike;
-            switch (version) {
-                case 0:
-                case 1:
-                    throw new Error("Unsupported Attestation Report Version");
-                case 2: {
-                    const chipId = attestationReport.slice(REPORT_OFFSETS.chipId, 64);
-                    if (equalBytes(chipId, new Uint8Array(64))) {
-                        throw new Error("Could not derive CPU family: MASK_CHIP_ID enabled");
-                    }
-                    turinLike = equalBytes(chipId.slice(8), new Uint8Array(56));
-                    break;
-                }
-                default: // from version 3 onwards CPUID_FAM_ID field should exist
-                    turinLike = attestationReport[REPORT_OFFSETS.cpuIdFamily] == 0x1a;
-            }
-            const reportedTcb = attestationReport.slice(REPORT_OFFSETS.reportedTcb, REPORT_OFFSETS.reportedTcb + 8);
-            let tcb;
-            if (turinLike) {
-                tcb = {
-                    microcode: reportedTcb[7],
-                    snp: reportedTcb[3],
-                    tee: reportedTcb[2],
-                    bootloader: reportedTcb[1],
-                    fmc: reportedTcb[0],
-                };
-            }
-            else {
-                tcb = {
-                    microcode: reportedTcb[7],
-                    snp: reportedTcb[6],
-                    tee: reportedTcb[1],
-                    bootloader: reportedTcb[0],
-                    fmc: 0,
-                };
-            }
-            if (!(tcb.microcode === vcekTcb.microcode &&
-                tcb.snp === vcekTcb.snp &&
-                tcb.tee === vcekTcb.tee &&
-                tcb.bootloader === vcekTcb.bootloader &&
-                tcb.fmc === vcekTcb.fmc)) {
-                throw new Error("Verification failed: REPORTED_TCB doesn't match with VCEK's TCB_VERSION");
-            }
-        });
-    }
-    _verifyReport(attestationReport, vcekChain) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (attestationReport.length != 1184) {
-                throw new Error(`Attestation report has unexpected length: ${attestationReport.length}`);
-            }
-            const { requirements, publicKey, vcekTcb } = yield this._verifyVcekChain(vcekChain);
-            if (!equalBytes(attestationReport.slice(REPORT_OFFSETS.signatureR + 48, REPORT_OFFSETS.signatureR + 72), new Uint8Array(24)) ||
-                !equalBytes(attestationReport.slice(REPORT_OFFSETS.signatureS + 48, REPORT_OFFSETS.signatureS + 72), new Uint8Array(24))) {
-                throw new Error("Unexpected signature bits");
-            }
-            const sig = new Uint8Array(96);
-            sig.set(attestationReport
-                .slice(REPORT_OFFSETS.signatureR, REPORT_OFFSETS.signatureR + 48)
-                // Change endianness
-                .reverse(), 0);
-            sig.set(attestationReport
-                .slice(REPORT_OFFSETS.signatureS, REPORT_OFFSETS.signatureS + 48)
-                // Change endianness
-                .reverse(), 48);
-            let valid;
-            try {
-                valid = p384.verify(sig, attestationReport.slice(0, 672), new Uint8Array(publicKey), { lowS: false });
-            }
-            catch (_a) {
-                valid = false;
-            }
-            if (!valid) {
-                throw new Error("Verification failed: Invalid attestation report signature");
-            }
-            if ((attestationReport[REPORT_OFFSETS.platInfo] &
-                (1 << PLATFORM_INFO_BITS.aliasCheckComplete)) ===
-                0) {
-                throw new Error("Verification failed: Alias check complete is false");
-            }
-            if (attestationReport[REPORT_OFFSETS.committedMajor] <
-                requirements.minCommittedVersion[0] ||
-                attestationReport[REPORT_OFFSETS.committedMinor] <
-                    requirements.minCommittedVersion[1] ||
-                attestationReport[REPORT_OFFSETS.committedBuild] <
-                    requirements.minCommittedVersion[2]) {
-                throw new Error("Verification failed: Firmware version too small");
-            }
-            if (attestationReport[REPORT_OFFSETS.committedTcbSnp] <
-                requirements.minCommittedTcbSnp) {
-                throw new Error("Verification failed: SNP patch level too small");
-            }
-            yield this._verifyTcbVersion(attestationReport, vcekTcb);
-        });
-    }
-    _verifyVcekChain(vcek) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let cert;
-            try {
-                cert = new x509.X509Certificate(vcek);
-            }
-            catch (e) {
-                throw new Error(`Invalid VCEK: ${e}\n\nVCEK: ${vcek}`);
-            }
-            const chain = yield ROOT_STORE.build(cert);
-            if (chain.length != 3) {
-                throw new Error(`Certificate chain verification failed\n\nChain: ${chain}`);
-            }
-            const find_extension = (oid, type) => {
-                const ext = chain[0].extensions.find((ext) => ext.type == oid);
-                if (!ext) {
-                    throw new Error(`Could not find ${type}\n\nExtensions: ${chain[0].extensions}`);
-                }
-                return new Uint8Array(ext.value);
-            };
-            const productIA5String = find_extension("1.3.6.1.4.1.3704.1.2", "product name");
-            if (productIA5String[0] !== 0x16) {
-                throw new Error(`Unexpected product extension: ${productIA5String}`);
-            }
-            const product = String.fromCharCode(...productIA5String.slice(2)).split("-", 1)[0];
-            if (!Object.prototype.hasOwnProperty.call(this._requirements, product)) {
-                throw new Error(`Unexpected product: ${product}`);
-            }
-            const subjectPublicKeyInfo = AsnConvert.parse(chain[0].publicKey.rawData, SubjectPublicKeyInfo);
-            const bootloader = find_extension("1.3.6.1.4.1.3704.1.3.1", "bootloader version")[2];
-            const tee = find_extension("1.3.6.1.4.1.3704.1.3.2", "TEE")[2];
-            const snp = find_extension("1.3.6.1.4.1.3704.1.3.3", "SNP version")[2];
-            const microcode = find_extension("1.3.6.1.4.1.3704.1.3.8", "microcode")[2];
-            const tcb = {
-                bootloader: bootloader,
-                tee: tee,
-                snp: snp,
-                microcode: microcode,
-                fmc: 0,
-            };
-            const fmc = chain[0].extensions.find((ext) => ext.type == "1.3.6.1.4.1.3704.1.3.9");
-            if (fmc) {
-                tcb.fmc = new Uint8Array(fmc.value)[2];
-            }
-            return {
-                requirements: this._requirements[product],
-                publicKey: new Uint8Array(subjectPublicKeyInfo.subjectPublicKey),
-                vcekTcb: tcb,
-            };
-        });
+        return unseal({ secret: this._secretKey, public: this._publicKey }, ciphertext);
     }
 }
-export function binaryStringToBytes(binaryString) {
+function binaryStringToBytes(binaryString) {
     return Uint8Array.from(binaryString, (c) => c.charCodeAt(0));
 }
-export function bytesToBinaryString(bytes) {
+function bytesToBinaryString(bytes) {
     return String.fromCharCode.apply(null, [...bytes]);
 }
-function _createCipher(publicKey, secretKey, info, nonce) {
-    const sharedSecret = x25519.getSharedSecret(secretKey, publicKey);
-    const key = hkdf(createHasher(() => blake2b.create({ dkLen: 64 })), sharedSecret, Uint8Array.from([]), info, 32);
-    return chacha20poly1305(key, nonce);
-}
-function _getInfo(ephemeralPublicKey, recipientPublicKey) {
-    const info = new Uint8Array(ephemeralPublicKey.length + recipientPublicKey.length);
-    info.set(ephemeralPublicKey);
-    info.set(recipientPublicKey, ephemeralPublicKey.length);
-    return info;
-}
-function _getSealNonce(ephemeralPublicKey, recipientPublicKey) {
-    return blake2b
-        .create({ dkLen: 12 })
-        .update(ephemeralPublicKey)
-        .update(recipientPublicKey)
-        .digest();
-}
-const REPORT_OFFSETS = {
-    sigAlgo: 52,
-    platInfo: 64,
-    reportData: 80,
-    measurement: 144,
-    reportedTcb: 384,
-    cpuIdFamily: 392,
-    chipId: 416,
-    committedTcbSnp: 486,
-    committedBuild: 492,
-    committedMinor: 493,
-    committedMajor: 494,
-    signatureR: 672,
-    signatureS: 744,
-};
-const PLATFORM_INFO_BITS = {
-    aliasCheckComplete: 5,
-};
+const _testing = _testing$1;
+
+export { KeySettlement, _testing, binaryStringToBytes, bytesToBinaryString };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "routex-settlement",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Key settlement for the YAXI routex client",
   "homepage": "https://yaxi.tech",
   "author": "YAXI GmbH",
@@ -11,14 +11,15 @@
   "types": "./index.d.ts",
   "files": [
     "index.d.ts",
-    "index.js"
+    "index.js",
+    "util.d.ts"
   ],
   "scripts": {
-    "build": "tsc --build",
+    "build": "rollup --input index.ts --dir . --plugin typescript --external @noble/ciphers/chacha.js,@noble/curves/ed25519.js,@noble/curves/nist.js,@noble/curves/utils.js,@noble/hashes/blake2.js,@noble/hashes/hkdf.js,@noble/hashes/sha2.js,@noble/hashes/utils.js,@peculiar/asn1-schema,@peculiar/asn1-x509,@peculiar/x509",
     "clean": "tsc --build --clean",
     "fmt": "prettier --write .",
     "lint": "eslint",
-    "test": "tsc --build && NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules\" jest"
+    "test": "npm run build && NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules\" jest"
   },
   "dependencies": {
     "@noble/ciphers": "^2.0.0",
@@ -30,10 +31,12 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.21.0",
+    "@rollup/plugin-typescript": "^12.1.4",
     "eslint": "^9.21.0",
     "globals": "^16.0.0",
     "jest": "^30.1.3",
     "prettier": "^3.6.2",
+    "rollup": "^4.52.2",
     "typescript": "^5.7.3",
     "typescript-eslint": "^8.24.1"
   }

package/util.d.ts

@@ -0,0 +1,40 @@
+declare const YAXI_SIGNING_KEYS: {
+    [id: string]: Uint8Array | undefined;
+};
+export declare function generateKey(): {
+    secret: Uint8Array;
+    public: Uint8Array;
+};
+export declare function seal(serverPublicKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+export declare function unseal(clientKey: {
+    secret: Uint8Array;
+    public: Uint8Array;
+}, ciphertext: Uint8Array): Uint8Array<ArrayBuffer>;
+type SettlementResponse = {
+    attestationReport: string;
+    vcek: string;
+    chachaBox: string;
+    systemVersion: {
+        kind: string;
+        generation: number;
+        createdAt: string;
+        ref: string;
+        launchMeasurement: string;
+        signature: {
+            keyId: string;
+            value: string;
+        };
+    };
+};
+type Requirements = {
+    [id: string]: {
+        minCommittedVersion: [number, number, number];
+        minCommittedTcbSnp: number;
+    };
+};
+export declare function verifyAttestation(response: SettlementResponse, requirements?: Requirements, signingKeys?: typeof YAXI_SIGNING_KEYS): Promise<Uint8Array>;
+export declare function bytesToUtf8(bytes: Uint8Array): Promise<string>;
+export declare const _testing: {
+    [Key: string]: unknown;
+};
+export {};