Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add API to retrieve the TCG Reference Integrity Manifest data. #209

Merged
merged 8 commits into from
Dec 9, 2024
Merged

Add API to retrieve the TCG Reference Integrity Manifest data. #209

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c7d6721
Add API to retrieve the TCG Reference Integrity Manifest data.
avanpo Nov 4, 2024
d2f4c58
Regenerate pb.go files after certz additions.
avanpo Nov 7, 2024
8fcba5d
Add documentation for the expected MBM-Boot workflow.
avanpo Nov 7, 2024
edfc183
Be more explicit about formats in field comments.
avanpo Dec 3, 2024
fc18220
Add docstring for GetIntegrityManifest endpoint response.
avanpo Dec 9, 2024
8c247d8
Amend docstring for GetIntegrityManifest endpoint.
avanpo Dec 9, 2024
e67b1d9
Lint fixes.
avanpo Dec 9, 2024
cc53aeb
Hopefully the last lint fix.
avanpo Dec 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions certz/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,27 @@ The connection to the network system is broken, there is no
The gNSI service rolls back the candidate and re-installs the original
authentication policy.

#### MBM-Boot workflow

See the TCG Reference Integrity Manifest (RIM) Information Model for more
details on the following
(https://trustedcomputinggroup.org/resource/tcg-reference-integrity-manifest-rim-information-model/).

Call `Certz.GetIntegrityManifest`. The `Certz.GetIntegrityManifestResponse`'s
`manifest` field will contain the reference integrity manifest. Determine the
PCRs to be included and all allowable digest values.

Send a `Certz.GenerateCSRRequest` to the `Certz.Rotate` endpoint, containing a
`Certz.ReferenceIntegritySpec`. Using the returned `Certz.GenerateCSRResponse`,
do the following. Verify the EK certificate chain, and verify the
AK by nonce and certification by EK. Validate PCR digest as signed by the
validated AK. Verify the digest matches with one of the allowed ones. Lastly,
validate the CSR by its AK signature, and then process and extract the public
key.

Get a new certificate issued by a trusted CA using the public key. Then
`Certz.Rotate` as normal.

### Open Questions/Considerations

None to date.
Expand Down
Loading
Loading