Tags: google/go-tpm-tools
Tags
Add SVSM e-vTPM support to go-tpm-tools (#600) * Add tpm.proto:CertifiedBlob and attest.proto:SevSnpSvsmAttestation These two messages are needed for TPM registration and SVSM support in the next patches. The generated code is the result of running `go generate ./...` inside proto/ * add dependencies for SVSM and TPM register support gce-tcb-verifier is used to verify the launch measurement in the SNP attestation report, and also to verify the endorsement that is used to verify the launch measurement. go-sev-guest is updated so as to avoid an attestation report parsing error for the v4 SNP attestation report format. go-tpm is updated to make use of new commands needed by TPM registration. go-configfs-tsm updated to retrieve the manifest blob which will contain the vtpm service manifest for SVSM attestation. the go.mod and go.sum updates were generated by running these commands: go get github.com/google/go-sev-guest@v0.14.0 go get github.com/google/go-tpm@v0.9.6 pushd cmd/ go get github.com/google/gce-tcb-verifier@v0.3.1 go get github.com/google/go-configfs-tsm@v0.3.3 go get github.com/google/gce-tcb-verifier/gcetcbendorsement@latest popd go mod tidy pushd cmd go mod tidy popd pushd verifier go mod tidy popd pushd launcher go mod tidy popd * implement EK-based Key attestation for the SVSM e-vTPM The client server files for import_certify.go corresponds to the spec for EK-based Key attestation with firmware version. See https://trustedcomputinggroup.org/wp-content/uploads/EK-Based-Key-Attestation-with-TPM-Firmware-Version-V1-RC1_9July2025.pdf#page=8 This will be used for SVSM attestation in the next patches. This is required for SVSM attestation because Coconut SVSM currently only attests to a single EK. * Add gotpm register command for EK-based TPM registration EK-based TPM registration consists of requesting a challenge, creating a challenge, solving the challenge, and verifying the challenge. Requesting a challenge corresponds to getting the EK public key via cmd/pubkey.go. Creating, solving and verifying the challenge correspond to subcommands defined in cmd/register.go. We also add some helpers for reading and writing files to flags.go and use them. * Add svsm subcommands to gotpm attest and verify `gotpm attest svsm` and `gotpm verify debug svsm` add svsm specific logic for verifying an SNP attestation report that is requested by Coconut SVSM on behalf of the linux guest. The SVSM spec defines a vTPM single service attestation protocol which allows the SNP attestation report instead of an EK certificate for creating trust in the TPM EK. We use SVSM's service attestation and the SNP hardware attestation report to create trust for the EK, instead of an EK certificate. See https://github.com/coconut-svsm/svsm for Coconut SVSM code which implements the SVSM spec interface. SVSM spec is found at https://www.amd.com/en/developer/sev.html We add the SevSnp attestation inside the SevSnpSvsmAttestation message instead of the Attestation message. AttestOpts is modified to allow running attest in a CVM without attempting to add the tee technology attestation. The full SVSM attestation flow follows these example commands: TEE_NONCE="123456789012345678901234567890123456789012345678901234567890123456789012345 " ALGO="ecc" "${gotpm}" pubkey endorsement --key-format=tpmt-public \ --algo=rsa --output=ek.bin "${gotpm}" register create-challenge --input=ek.bin \ --output=challenge.bin --secret-output=secret.bin "${gotpm}" register solve-challenge --input=challenge.bin --algo=${ALGO} \ --output=certified_blob.bin "${gotpm}" register verify-challenge --input=certified_blob.bin \ --secret-input=secret.bin "${gotpm}" attest svsm --nonce=1234 --output=svsm_attestation.bin \ --algo=${ALGO} --key=AK --tee-nonce="${TEE_NONCE}" \ --tee-technology=sev-snp "${gotpm}" verify debug svsm --nonce=1234 --input=svsm_attestation.bin \ --tee-technology=sev-snp --certified-ak-blob=certified_blob.bin \ --ek-pub=ek.bin --tee-nonce="${TEE_NONCE}" * please the gcbrun container image lint settings made these manual edits to auto generated files the presubmit runs go generate commands and then checks for diffs with: git diff -G'^[^/]' --exit-code however, these are comment lines? and i think the diff command shoulda skipped those? oh well, let's try it now. --------- Co-authored-by: Jacob Xu <jacobhxu@google.com>
Add HashNonce flag to Attest and VerifyAttestation (#585) Currently, key.Attest takes a slice of data for the attestation nonce. This gets passed directly to the TPM. However, verifiers that are not aware of the TPM's max size for extraData can inadvertently send a challenge that is too large. This change introduces a HashNonce flag that uses the key's signing scheme hash algorithm to first hash the AttestOpts nonce. The server package also introduces the same logic to hash the nonce based on the Attestation message's AkPub signing scheme. This allows verifiers to send an arbitrary amount of entropy without knowing the max hash size of the TPM.
Update API version to include new principal tag token type and tokent… …ype options (#515) Add new tokentype fields to JSON api in the TEE server Fix tee server tests with new model Co-authored-by: Joshua Krstic <jkrstic@google.com>
Update API version to include new principal tag token type and tokent… …ype options (#515) Add new tokentype fields to JSON api in the TEE server Fix tee server tests with new model Co-authored-by: Joshua Krstic <jkrstic@google.com>
Release v0.4.3 (#416) New Features: [launcher] Add TEE server IPC implementation #367 [launcher] Enable memory monitoring in CS #391 Use TDX quote provider to attest and verify #405 Integrate nonce verification as part of the TDX quote validation procedure. #395 Add RISC V support #407 [launcher] Use resizable integrity-fs with in-memory tags #412 Bug Fixes: [launcher] Fix launcher exit code #384 [launcher] Handle exit code checking during deferral evaluation #392 [cmd] Skip tests that call setGCEAKTemplate #402 [launcher] Fix teeserver context reset issue & add container signature cache #397 Set all unused parameters as _ to fix CI lint failure #411 [launcher] Make customtoken test sleep to mitigate clock skew #413 Other Changes: Add eventlog parse logics for memory monitoring #404 [launcher]: Add memory monitor measurement logics #408 Update go-tdx-guest version to v0.3.1 #414 New Contributors: @KeithMoyer in #392 @vbalain in #405 @aimixsaka in #407
Release v0.4.2 (#385) New Features: [launcher] Add experiment support #352 [launcher] Integrate signature discovery client into attestation agent #343 Bug Fixes: Make launcher host tmp directory before experiment fetch #363 Other Changes: [launcher] Print kernel cmdline on builds #268 Import latest version of go-tdx-guest #373 [launcher] Print signature details instead of signature object #374 [launcher] Add image tests for the experiments binary #378 Update go-sev-guest to v0.9.3 #381
PreviousNext