diff --git a/go.mod b/go.mod index a8a60ad..88a369e 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/lestrrat-go/jwx/v2 v2.0.8 github.com/stretchr/testify v1.8.1 github.com/veraison/eat v0.0.0-20220117140849-ddaf59d69f53 - github.com/veraison/go-cose v1.1.0 + github.com/veraison/go-cose v1.2.1 github.com/veraison/psatoken v1.2.1-0.20240719122628-26fe500fd5d4 ) diff --git a/go.sum b/go.sum index b4fd58e..69174ba 100644 --- a/go.sum +++ b/go.sum @@ -37,8 +37,8 @@ github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKs github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/veraison/eat v0.0.0-20220117140849-ddaf59d69f53 h1:5gnX2TrGd/Xz8DOp2OaLtg/jLoIubSUTrgz6iZ58pJ4= github.com/veraison/eat v0.0.0-20220117140849-ddaf59d69f53/go.mod h1:+kxt8iuFiVvKRs2VQ1Ho7bbAScXAB/kHFFuP5Biw19I= -github.com/veraison/go-cose v1.1.0 h1:AalPS4VGiKavpAzIlBjrn7bhqXiXi4jbMYY/2+UC+4o= -github.com/veraison/go-cose v1.1.0/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4= +github.com/veraison/go-cose v1.2.1 h1:Gj4x20D0YP79J2+cK3anjGEMwIkg2xX+TKVVGUXwNAc= +github.com/veraison/go-cose v1.2.1/go.mod h1:t6V8WJzHm1PD5HNsuDjW3KLv577uWb6UTzbZGvdQHD8= github.com/veraison/psatoken v1.2.1-0.20240719122628-26fe500fd5d4 h1:N7qg7vDF2mUg7I+8AoU+ieJ20cgcShwFHXHkV5b2YAA= github.com/veraison/psatoken v1.2.1-0.20240719122628-26fe500fd5d4/go.mod h1:6+WZzXr0ACXYiUAJJqTaCxW43gY2+gEaCoVNdDv3+Bw= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= diff --git a/platform/claims.go b/platform/claims.go index f88d215..1c44db2 100644 --- a/platform/claims.go +++ b/platform/claims.go @@ -11,7 +11,8 @@ import ( "github.com/veraison/psatoken" ) -const ProfileName = "http://arm.com/CCA-SSD/1.0.0" +const ProfileNameLegacy = "http://arm.com/CCA-SSD/1.0.0" +const ProfileName = "tag:arm.com,2023:cca_platform#1.0.0" // Profile is the psatoken.IProfile implementation for CCA claims. It is // registered to associate the claims with the profile name, so that it can be @@ -22,6 +23,10 @@ func (o Profile) GetName() string { return ProfileName } +func (o Profile) GetNameLegacy() string { + return ProfileNameLegacy +} + func (o Profile) GetClaims() psatoken.IClaims { return NewClaims() } @@ -212,7 +217,7 @@ func (c *Claims) GetProfile() (string, error) { return "", err } - if profileString != c.CanonicalProfile { + if profileString != c.CanonicalProfile && profileString != ProfileNameLegacy { return "", fmt.Errorf("%w: expecting %q, got %q", psatoken.ErrWrongProfile, c.CanonicalProfile, profileString) } diff --git a/platform/claims_test.go b/platform/claims_test.go index 44b32e2..87916b3 100644 --- a/platform/claims_test.go +++ b/platform/claims_test.go @@ -182,7 +182,6 @@ func Test_CCAPlatform_UnmarshalCBOR_ok_mandatory_only(t *testing.T) { actualSwComp, err := c.GetSoftwareComponents() assert.NoError(t, err) assert.Equal(t, expectedSwComp, actualSwComp) - } func Test_CCAPlatform_Claims_UnmarshalCBOR_bad_input(t *testing.T) { @@ -216,7 +215,7 @@ func Test_CCAPlatform_MarshalJSON_ok(t *testing.T) { c := mustBuildValidClaims(t, true) expected := `{ - "cca-platform-profile": "http://arm.com/CCA-SSD/1.0.0", + "cca-platform-profile": "tag:arm.com,2023:cca_platform#1.0.0", "cca-platform-challenge": "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=", "cca-platform-implementation-id":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", "cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC", @@ -309,18 +308,16 @@ func Test_CCAPlatform_UnmarshalJSON_negatives(t *testing.T) { func Test_DecodeClaims_CCAPlatform_ok(t *testing.T) { tvs := []string{ testEncodedCcaPlatformClaimsAll, + testEncodedCcaPlatformLegacyClaimsAll, testEncodedCcaPlatformClaimsMandatoryOnly, + testEncodedCcaPlatformLegacyClaimsMandatoryOnly, } for _, tv := range tvs { buf := mustHexDecode(t, tv) - c, err := DecodeAndValidateClaimsFromCBOR(buf) - - assert.NoError(t, err) + _, err := DecodeAndValidateClaimsFromCBOR(buf) - actualProfile, err := c.GetProfile() assert.NoError(t, err) - assert.Equal(t, ProfileName, actualProfile) } } @@ -374,7 +371,7 @@ func Test_DecodeJSONClaims_CcaPlatform(t *testing.T) { assert.NoError(t, err) actualProfile, err := c.GetProfile() assert.NoError(t, err) - assert.Equal(t, ProfileName, actualProfile) + assert.Equal(t, ProfileNameLegacy, actualProfile) } func Test_DecodeUnvalidatedJSONCCAClaims(t *testing.T) { diff --git a/platform/pretty_test_vectors.go b/platform/pretty_test_vectors.go index 958eb27..fd7a9ea 100644 --- a/platform/pretty_test_vectors.go +++ b/platform/pretty_test_vectors.go @@ -1,10 +1,22 @@ -// Copyright 2021-2024 Contributors to the Veraison project. -// SPDX-License-Identifier: Apache-2.0 - package platform // automatically generated from CcaPlatformClaimsAll.diag var testEncodedCcaPlatformClaimsAll = ` +a919010978237461673a61726d2e636f6d2c323032333a6363615f706c61 +74666f726d23312e302e300a582001010101010101010101010101010101 +0101010101010101010101010101010119095c5820000000000000000000 +000000000000000000000000000000000000000000000019010058210102 +020202020202020202020202020202020202020202020202020202020202 +021909614301020319095b19300019095f81a20258200303030303030303 +030303030303030303030303030303030303030303030303055820040404 +040404040404040404040404040404040404040404040404040404040419 +0960782e68747470733a2f2f7665726169736f6e2e6578616d706c652f76 +312f6368616c6c656e67652d726573706f6e7365190962677368612d3235 +36 +` + +// automatically generated from CcaPlatformLegacyClaimsAll.diag +var testEncodedCcaPlatformLegacyClaimsAll = ` a9190109781c687474703a2f2f61726d2e636f6d2f4343412d5353442f31 2e302e300a58200101010101010101010101010101010101010101010101 01010101010101010119095c582000000000000000000000000000000000 @@ -17,6 +29,32 @@ a9190109781c687474703a2f2f61726d2e636f6d2f4343412d5353442f31 656e67652d726573706f6e7365190962677368612d323536 ` +// automatically generated from CcaPlatformClaimsMandatoryOnly.diag +var testEncodedCcaPlatformClaimsMandatoryOnly = ` +a819010978237461673a61726d2e636f6d2c323032333a6363615f706c61 +74666f726d23312e302e300a582001010101010101010101010101010101 +0101010101010101010101010101010119095c5820000000000000000000 +000000000000000000000000000000000000000000000019010058210102 +020202020202020202020202020202020202020202020202020202020202 +021909614301020319095b19300019095f81a20258200303030303030303 +030303030303030303030303030303030303030303030303055820040404 +040404040404040404040404040404040404040404040404040404040419 +0962677368612d323536 +` + +// automatically generated from CcaPlatformLegacyClaimsMandatoryOnly.diag +var testEncodedCcaPlatformLegacyClaimsMandatoryOnly = ` +a8190109781c687474703a2f2f61726d2e636f6d2f4343412d5353442f31 +2e302e300a58200101010101010101010101010101010101010101010101 +01010101010101010119095c582000000000000000000000000000000000 +000000000000000000000000000000001901005821010202020202020202 +020202020202020202020202020202020202020202020202190961430102 +0319095b19300019095f81a2025820030303030303030303030303030303 +030303030303030303030303030303030305582004040404040404040404 +04040404040404040404040404040404040404040404190962677368612d +323536 +` + // automatically generated from CcaPlatformClaimsInvalidMultiNonce.diag var testEncodedCcaPlatformClaimsInvalidMultiNonce = ` a9190109781c687474703a2f2f61726d2e636f6d2f4343412d5353442f31 @@ -32,19 +70,6 @@ a9190109781c687474703a2f2f61726d2e636f6d2f4343412d5353442f31 6368616c6c656e67652d726573706f6e7365190962677368612d323536 ` -// automatically generated from CcaPlatformClaimsMandatoryOnly.diag -var testEncodedCcaPlatformClaimsMandatoryOnly = ` -a8190109781c687474703a2f2f61726d2e636f6d2f4343412d5353442f31 -2e302e300a58200101010101010101010101010101010101010101010101 -01010101010101010119095c582000000000000000000000000000000000 -000000000000000000000000000000001901005821010202020202020202 -020202020202020202020202020202020202020202020202190961430102 -0319095b19300019095f81a2025820030303030303030303030303030303 -030303030303030303030303030303030305582004040404040404040404 -04040404040404040404040404040404040404040404190962677368612d -323536 -` - // automatically generated from CcaPlatformClaimsMissingMandatoryNonce.diag var testEncodedCcaPlatformClaimsMissingMandatoryNonce = ` a8190109781c687474703a2f2f61726d2e636f6d2f4343412d5353442f31 diff --git a/platform/testvectors/cbor/CcaPlatformClaimsAll.diag b/platform/testvectors/cbor/CcaPlatformClaimsAll.diag index ff73750..4ff00fc 100644 --- a/platform/testvectors/cbor/CcaPlatformClaimsAll.diag +++ b/platform/testvectors/cbor/CcaPlatformClaimsAll.diag @@ -1,5 +1,5 @@ { - 265: "http://arm.com/CCA-SSD/1.0.0", + 265: "tag:arm.com,2023:cca_platform#1.0.0", 10: h'0101010101010101010101010101010101010101010101010101010101010101', 2396: h'0000000000000000000000000000000000000000000000000000000000000000', 256: h'010202020202020202020202020202020202020202020202020202020202020202', diff --git a/platform/testvectors/cbor/CcaPlatformClaimsMandatoryOnly.diag b/platform/testvectors/cbor/CcaPlatformClaimsMandatoryOnly.diag index e8a2272..70e3484 100644 --- a/platform/testvectors/cbor/CcaPlatformClaimsMandatoryOnly.diag +++ b/platform/testvectors/cbor/CcaPlatformClaimsMandatoryOnly.diag @@ -1,5 +1,5 @@ { - 265: "http://arm.com/CCA-SSD/1.0.0", + 265: "tag:arm.com,2023:cca_platform#1.0.0", 10: h'0101010101010101010101010101010101010101010101010101010101010101', 2396: h'0000000000000000000000000000000000000000000000000000000000000000', 256: h'010202020202020202020202020202020202020202020202020202020202020202', diff --git a/platform/testvectors/cbor/CcaPlatformExample.diag b/platform/testvectors/cbor/CcaPlatformExample.diag new file mode 100644 index 0000000..a26f62d --- /dev/null +++ b/platform/testvectors/cbor/CcaPlatformExample.diag @@ -0,0 +1,25 @@ +{ + 265: "tag:arm.com,2023:cca_platform#1.0.0", + 10: h'0D22E08A98469058486318283489BDB36F09DBEFEB1864DF433FA6E54EA2D711', + 2396: h'7F454C4602010100000000000000000003003E00010000005058000000000000', + 256: h'0107060504030201000F0E0D0C0B0A090817161514131211101F1E1D1C1B1A1918', + 2401: h'CFCFCFCF', + 2395: 12291, + 2402: "sha-256", + 2400: "https://veraison.example/.well-known/veraison/verification", + 2399: [ + { 1: "RSE_BL1_2", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'9A271F2A916B0B6EE6CECB2426F0B3206EF074578BE55D9BC94F6F3FE3AB86AA', 6: "sha-256" }, + { 1: "RSE_BL2", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'53C234E5E8472B6AC51C1AE1CAB3FE06FAD053BEB8EBFD8977B010655BFDD3C3', 6: "sha-256" }, + { 1: "RSE_S", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'1121CFCCD5913F0A63FEC40A6FFD44EA64F9DC135C66634BA001D10BCF4302A2', 6: "sha-256" }, + { 1: "AP_BL1", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'1571B5EC78BD68512BF7830BB6A2A44B2047C7DF57BCE79EB8A1C0E5BEA0A501', 6: "sha-256" }, + { 1: "AP_BL2", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'10159BAF262B43A92D95DB59DAE1F72C645127301661E0A3CE4E38B295A97C58', 6: "sha-256" }, + { 1: "SCP_BL1", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'10122E856B3FCD49F063636317476149CB730A1AA1CFAAD818552B72F56D6F68', 6: "sha-256" }, + { 1: "SCP_BL2", 5: h'F14B4987904BCB5814E4459A057ED4D20F58A633152288A761214DCD28780B56', 2: h'AA67A169B0BBA217AA0AA88A65346920C84C42447C36BA5F7EA65F422C1FE5D8', 6: "sha-256" }, + { 1: "AP_BL31", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'2E6D31A5983A91251BFAE5AEFA1C0A19D8BA3CF601D0E8A706B4CFA9661A6B8A', 6: "sha-256" }, + { 1: "RMM", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'A1FB50E6C86FAE1679EF3351296FD6713411A08CF8DD1790A4FD05FAE8688164', 6: "sha-256" }, + { 1: "HW_CONFIG", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'1A252402972F6057FA53CC172B52B9FFCA698E18311FACD0F3B06ECAAEF79E17', 6: "sha-256" }, + { 1: "FW_CONFIG", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'9A92ADBC0CEE38EF658C71CE1B1BF8C65668F166BFB213644C895CCB1AD07A25', 6: "sha-256" }, + { 1: "TB_FW_CONFIG", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'238903180CC104EC2C5D8B3F20C5BC61B389EC0A967DF8CC208CDC7CD454174F', 6: "sha-256" }, + { 1: "SOC_FW_CONFIG", 5: h'5378796307535DF3EC8D8B15A2E2DC5641419C3D3060CFE32238C0FA973F7AA3', 2: h'E6C21E8D260FE71882DEBDB339D2402A2CA7648529BC2303F48649BCE0380017', 6: "sha-256" } + ] +} diff --git a/platform/testvectors/cbor/CcaPlatformLegacyClaimsAll.diag b/platform/testvectors/cbor/CcaPlatformLegacyClaimsAll.diag new file mode 100644 index 0000000..ff73750 --- /dev/null +++ b/platform/testvectors/cbor/CcaPlatformLegacyClaimsAll.diag @@ -0,0 +1,16 @@ +{ + 265: "http://arm.com/CCA-SSD/1.0.0", + 10: h'0101010101010101010101010101010101010101010101010101010101010101', + 2396: h'0000000000000000000000000000000000000000000000000000000000000000', + 256: h'010202020202020202020202020202020202020202020202020202020202020202', + 2401: h'010203', + 2395: 12288, + 2399: [ + { + 2: h'0303030303030303030303030303030303030303030303030303030303030303', + 5: h'0404040404040404040404040404040404040404040404040404040404040404' + } + ], + 2400: "https://veraison.example/v1/challenge-response", + 2402: "sha-256" +} diff --git a/platform/testvectors/cbor/CcaPlatformLegacyClaimsMandatoryOnly.diag b/platform/testvectors/cbor/CcaPlatformLegacyClaimsMandatoryOnly.diag new file mode 100644 index 0000000..e8a2272 --- /dev/null +++ b/platform/testvectors/cbor/CcaPlatformLegacyClaimsMandatoryOnly.diag @@ -0,0 +1,15 @@ +{ + 265: "http://arm.com/CCA-SSD/1.0.0", + 10: h'0101010101010101010101010101010101010101010101010101010101010101', + 2396: h'0000000000000000000000000000000000000000000000000000000000000000', + 256: h'010202020202020202020202020202020202020202020202020202020202020202', + 2401: h'010203', + 2395: 12288, + 2399: [ + { + 2: h'0303030303030303030303030303030303030303030303030303030303030303', + 5: h'0404040404040404040404040404040404040404040404040404040404040404' + } + ], + 2402: "sha-256" +} diff --git a/platform/testvectors/cbor/build-test-vectors.sh b/platform/testvectors/cbor/build-test-vectors.sh index 47fbb4e..0f0185c 100755 --- a/platform/testvectors/cbor/build-test-vectors.sh +++ b/platform/testvectors/cbor/build-test-vectors.sh @@ -7,13 +7,15 @@ set -o pipefail DIAG_FILES= DIAG_FILES="${DIAG_FILES} CcaPlatformClaimsAll" -DIAG_FILES="${DIAG_FILES} CcaPlatformClaimsInvalidMultiNonce" +DIAG_FILES="${DIAG_FILES} CcaPlatformLegacyClaimsAll" DIAG_FILES="${DIAG_FILES} CcaPlatformClaimsMandatoryOnly" +DIAG_FILES="${DIAG_FILES} CcaPlatformLegacyClaimsMandatoryOnly" +DIAG_FILES="${DIAG_FILES} CcaPlatformClaimsInvalidMultiNonce" DIAG_FILES="${DIAG_FILES} CcaPlatformClaimsMissingMandatoryNonce" TV_DOT_GO=${TV_DOT_GO?must be set in the environment.} -printf "package psatoken\n\n" > ${TV_DOT_GO} +printf "package platform\n\n" > ${TV_DOT_GO} for t in ${DIAG_FILES} do diff --git a/realm/claims.go b/realm/claims.go index d001701..beffce9 100644 --- a/realm/claims.go +++ b/realm/claims.go @@ -8,16 +8,30 @@ import ( "github.com/veraison/psatoken" ) +const ProfileName = "tag:arm.com,2023:realm#1.0.0" + // Claims contains the CCA realm claims. It implements IClaims, which is an // extension of psatoken.IClaimBase. type Claims struct { - Challenge *eat.Nonce `cbor:"10,keyasint" json:"cca-realm-challenge"` - PersonalizationValue *[]byte `cbor:"44235,keyasint" json:"cca-realm-personalization-value"` - InitialMeasurement *[]byte `cbor:"44238,keyasint" json:"cca-realm-initial-measurement"` - ExtensibleMeasurements *[][]byte `cbor:"44239,keyasint" json:"cca-realm-extensible-measurements"` - HashAlgID *string `cbor:"44236,keyasint" json:"cca-realm-hash-algo-id"` - PublicKey *[]byte `cbor:"44237,keyasint" json:"cca-realm-public-key"` - PublicKeyHashAlgID *string `cbor:"44240,keyasint" json:"cca-realm-public-key-hash-algo-id"` + Profile *eat.Profile `cbor:"265,keyasint" json:"cca-realm-profile,omitempty"` + Challenge *eat.Nonce `cbor:"10,keyasint" json:"cca-realm-challenge"` + PersonalizationValue *[]byte `cbor:"44235,keyasint" json:"cca-realm-personalization-value"` + InitialMeasurement *[]byte `cbor:"44238,keyasint" json:"cca-realm-initial-measurement"` + ExtensibleMeasurements *[][]byte `cbor:"44239,keyasint" json:"cca-realm-extensible-measurements"` + HashAlgID *string `cbor:"44236,keyasint" json:"cca-realm-hash-algo-id"` + PublicKey *[]byte `cbor:"44237,keyasint" json:"cca-realm-public-key"` + PublicKeyHashAlgID *string `cbor:"44240,keyasint" json:"cca-realm-public-key-hash-algo-id"` +} + +// NewClaims claims returns a new instance of Claims. +func NewClaims() IClaims { + p := eat.Profile{} + if err := p.Set(ProfileName); err != nil { + // should never get here as using known good constant as input + panic(err) + } + + return &Claims{Profile: &p} } // Setters @@ -73,8 +87,14 @@ func (c *Claims) SetHashAlgID(v string) error { } func (c *Claims) SetPubKey(v []byte) error { - if err := ValidateRealmPubKey(v); err != nil { - return err + if c.Profile == nil { + if err := ValidateRealmPubKey(v); err != nil { + return err + } + } else { + if err := ValidateRealmPubKeyCOSE(v); err != nil { + return err + } } c.PublicKey = &v @@ -110,6 +130,25 @@ func (c Claims) GetChallenge() ([]byte, error) { return n, nil } +// If profile is not found return ErrOptionalClaimMissing +// func (c *Claims) GetProfile() (string, error) { +// if c.Profile == nil { +// return "", psatoken.ErrOptionalClaimMissing +// } + +// profileString, err := c.Profile.Get() +// if err != nil { +// return "", err +// } + +// if profileString != c.CanonicalProfile { +// return "", fmt.Errorf("%w: expecting %q, got %q", +// psatoken.ErrWrongProfile, c.CanonicalProfile, profileString) +// } + +// return c.Profile.Get() +// } + func (c Claims) GetPersonalizationValue() ([]byte, error) { v := c.PersonalizationValue @@ -168,8 +207,14 @@ func (c Claims) GetPubKey() ([]byte, error) { return nil, psatoken.ErrMandatoryClaimMissing } - if err := ValidateRealmPubKey(*v); err != nil { - return nil, err + if c.Profile == nil { + if err := ValidateRealmPubKey(*v); err != nil { + return nil, err + } + } else { + if err := ValidateRealmPubKeyCOSE(*v); err != nil { + return nil, err + } } return *v, nil diff --git a/realm/claims_test.go b/realm/claims_test.go index 7830a33..a6c4f67 100644 --- a/realm/claims_test.go +++ b/realm/claims_test.go @@ -26,7 +26,7 @@ func mustBuildValidCcaRealmClaims(t *testing.T) IClaims { err = c.SetHashAlgID(testHashAlgID) require.NoError(t, err) - err = c.SetPubKey(testRAKPubRaw) + err = c.SetPubKey(testRAKPubCOSE) require.NoError(t, err) err = c.SetPubKeyHashAlgID(testPubKeyHashAlgID) @@ -66,8 +66,8 @@ func Test_CcaRealmClaims_Set_nok(t *testing.T) { assert.EqualError(t, err, expectedErr) err = c.SetPubKey([]byte("not-a-valid-point")) - expectedErr = "wrong syntax: length 17 (realm public key MUST be 97 bytes)" - assert.EqualError(t, err, expectedErr) + expectedErr = "wrong syntax" + assert.ErrorContains(t, err, expectedErr) err = c.SetPubKey([]byte{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, @@ -80,8 +80,8 @@ func Test_CcaRealmClaims_Set_nok(t *testing.T) { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }) - expectedErr = "wrong syntax: checking raw public key coordinates are on curve P-384: failed to unmarshal elliptic curve point" - assert.EqualError(t, err, expectedErr) + expectedErr = "wrong syntax" + assert.ErrorContains(t, err, expectedErr) err = c.SetPubKeyHashAlgID("") expectedErr = "invalid null string set for realm pubkey hash alg ID" @@ -140,7 +140,7 @@ func Test_CcaRealmClaims_UnmarshalCBOR_ok(t *testing.T) { assert.NoError(t, err) assert.Equal(t, expectedHashAlgID, actualHashAlgID) - expectedPubKey := testRAKPubRaw + expectedPubKey := testRAKPubCOSE actualPubKey, err := c.GetPubKey() assert.NoError(t, err) assert.Equal(t, expectedPubKey, actualPubKey) @@ -191,6 +191,7 @@ func Test_CcaRealm_Claims_MarshalJSON_ok(t *testing.T) { c := mustBuildValidCcaRealmClaims(t) expected := `{ + "cca-realm-profile": "tag:arm.com,2023:realm#1.0.0", "cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==", "cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==", "cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==", @@ -202,7 +203,7 @@ func Test_CcaRealm_Claims_MarshalJSON_ok(t *testing.T) { ] , "cca-realm-hash-algo-id": "sha-256", - "cca-realm-public-key": "BIEZWICiIH+5VgMqPLl/XaWvcm/8txXuFkeEp/sWwGCWvdlGKjJlCykSqFUVcNbqHzstH32oonX6ADMPAHhhi8PhSVScgXDTLsVYkKf57HifHxiukusV0iKvlx2XHJZa8Q==", + "cca-realm-public-key": "pAECIAIhWDB2+YgJG+WF7UGAGuz6uFhUjGMFfhaw5nYSC70NL5wp4FbF1BoBMOucIVF4mdwjFGsiWDAo4bBivT6ksxX9IZ8cu1KMtudMpJvhZ3NzT2GhymEDGyu/PZGPL5T/xCKOUJGVRK4=", "cca-realm-public-key-hash-algo-id": "sha-512" }` actual, err := ValidateAndEncodeClaimsToJSON(c) @@ -223,7 +224,7 @@ func Test_CcaRealmClaims_UnmarshalJSON_ok(t *testing.T) { ] , "cca-realm-hash-algo-id": "sha-256", - "cca-realm-public-key": "BIEZWICiIH+5VgMqPLl/XaWvcm/8txXuFkeEp/sWwGCWvdlGKjJlCykSqFUVcNbqHzstH32oonX6ADMPAHhhi8PhSVScgXDTLsVYkKf57HifHxiukusV0iKvlx2XHJZa8Q==", + "cca-realm-public-key": "pAECIAIhWDB2+YgJG+WF7UGAGuz6uFhUjGMFfhaw5nYSC70NL5wp4FbF1BoBMOucIVF4mdwjFGsiWDAo4bBivT6ksxX9IZ8cu1KMtudMpJvhZ3NzT2GhymEDGyu/PZGPL5T/xCKOUJGVRK4=", "cca-realm-public-key-hash-algo-id": "sha-512" }` _, err := DecodeAndValidateClaimsFromJSON([]byte(tv)) diff --git a/realm/common.go b/realm/common.go index 186f68f..26ecf4f 100644 --- a/realm/common.go +++ b/realm/common.go @@ -6,6 +6,8 @@ import ( "errors" "fmt" + cose "github.com/veraison/go-cose" + "github.com/veraison/psatoken" ) @@ -64,6 +66,32 @@ func ValidateRealmPubKey(b []byte) error { return nil } +// ValidateRealmPubKeyCOSE returns an error if the provided value does not +// contain a valid realm public key in CBOR-encoded COSE_Key format +func ValidateRealmPubKeyCOSE(b []byte) error { + var k cose.Key + + if err := k.UnmarshalCBOR(b); err != nil { + return fmt.Errorf( + "%w: checking realm public key is a CBOR-encoded COSE_Key: %v", + psatoken.ErrWrongSyntax, err, + ) + } + + if k.KeyType != cose.KeyTypeEC2 { + return fmt.Errorf("%w: realm public key is not EC2", psatoken.ErrWrongSyntax) + } + + if err := k.Validate(); err != nil { + return fmt.Errorf( + "%w: validating EC2 realm public key: %v", + psatoken.ErrWrongSyntax, err, + ) + } + + return nil +} + // ValidateRealmMeas returns an error if the provided value does not contain a // valid realm measurement (must be 32, 48, or 64 bytes long). func ValidateRealmMeas(b []byte) error { diff --git a/realm/iclaims.go b/realm/iclaims.go index 46fdbe1..f1bb80a 100644 --- a/realm/iclaims.go +++ b/realm/iclaims.go @@ -33,11 +33,6 @@ type IClaims interface { SetPubKeyHashAlgID(string) error } -// NewClaims returns a new instance of realm claims. -func NewClaims() IClaims { - return &Claims{} -} - // DecodeAndValidateClaimsFromCBOR unmarshals and validates CCA realm claims // from provided CBOR data. func DecodeAndValidateClaimsFromCBOR(buf []byte) (IClaims, error) { diff --git a/realm/pretty_test_vectors.go b/realm/pretty_test_vectors.go index 21c26e3..1e39229 100644 --- a/realm/pretty_test_vectors.go +++ b/realm/pretty_test_vectors.go @@ -2,111 +2,164 @@ package realm // automatically generated from CcaRealmClaimsAll.diag var testEncodedCcaRealmClaimsAll = ` -a70a58404142414241424142414241424142414241424142414241424142 -414241424142414241424142414241424142414241424142414241424142 -414241424142414219accb58404144414441444144414441444144414441 -444144414441444144414441444144414441444144414441444144414441 -444144414441444144414441444144414419acce58404343434343434343 +a8190109781c7461673a61726d2e636f6d2c323032333a7265616c6d2331 +2e302e300a58404142414241424142414241424142414241424142414241 +424142414241424142414241424142414241424142414241424142414241 +424142414241424142414219accb58404144414441444144414441444144 +414441444144414441444144414441444144414441444144414441444144 +414441444144414441444144414441444144414419acce58404343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343434343434343434343434343434319accf84 -584043434343434343434343434343434343434343434343434343434343 +434343434343434343434343434343434343434343434343434343434319 +accf84584043434343434343434343434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343584043434343434343434343434343434343434343434343 +434343434343434343584043434343434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343584043434343434343434343434343434343 +434343434343434343434343434343584043434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343434343434343584043434343434343434343 +434343434343434343434343434343434343434343584043434343434343 434343434343434343434343434343434343434343434343434343434343 -43434343434343434343434343434343434343434343434319accc677368 -612d32353619accd58610481195880a2207fb956032a3cb97f5da5af726f -fcb715ee164784a7fb16c06096bdd9462a32650b2912a8551570d6ea1f3b -2d1f7da8a275fa00330f0078618bc3e149549c8170d32ec55890a7f9ec78 -9f1f18ae92eb15d222af971d971c965af119acd0677368612d353132 +43434343434343434343434343434343434343434343434343434319accc +677368612d32353619accd586ba40102200221583076f988091be585ed41 +801aecfab858548c63057e16b0e676120bbd0d2f9c29e056c5d41a0130eb +9c21517899dc23146b22583028e1b062bd3ea4b315fd219f1cbb528cb6e7 +4ca49be16773734f61a1ca61031b2bbf3d918f2f94ffc4228e50919544ae +19acd0677368612d353132 ` // automatically generated from CcaClaimsMissingMandPubKey.diag var testEncodedCcaClaimsMissingMandPubKey = ` -a60a58404142414241424142414241424142414241424142414241424142 -414241424142414241424142414241424142414241424142414241424142 -414241424142414219accb58404144414441444144414441444144414441 -444144414441444144414441444144414441444144414441444144414441 -444144414441444144414441444144414419acce58404343434343434343 +a7190109781c7461673a61726d2e636f6d2c323032333a7265616c6d2331 +2e302e300a58404142414241424142414241424142414241424142414241 +424142414241424142414241424142414241424142414241424142414241 +424142414241424142414219accb58404144414441444144414441444144 +414441444144414441444144414441444144414441444144414441444144 +414441444144414441444144414441444144414419acce58404343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343434343434343434343434343434319accf84 -584043434343434343434343434343434343434343434343434343434343 +434343434343434343434343434343434343434343434343434343434319 +accf84584043434343434343434343434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343584043434343434343434343434343434343434343434343 +434343434343434343584043434343434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343584043434343434343434343434343434343 +434343434343434343434343434343584043434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343434343434343584043434343434343434343 +434343434343434343434343434343434343434343584043434343434343 434343434343434343434343434343434343434343434343434343434343 -43434343434343434343434343434343434343434343434319accc677368 -612d32353619acd0677368612d353132 +43434343434343434343434343434343434343434343434343434319accc +677368612d32353619acd0677368612d353132 ` // automatically generated from CcaClaimsMissingMandExtendedMeas.diag var testEncodedCcaClaimsMissingMandExtendedMeas = ` -a60a58404142414241424142414241424142414241424142414241424142 -414241424142414241424142414241424142414241424142414241424142 -414241424142414219accb58404144414441444144414441444144414441 -444144414441444144414441444144414441444144414441444144414441 -444144414441444144414441444144414419acce58404343434343434343 -434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343434343434343434343434343434319accc67 -7368612d32353619accd58610481195880a2207fb956032a3cb97f5da5af -726ffcb715ee164784a7fb16c06096bdd9462a32650b2912a8551570d6ea -1f3b2d1f7da8a275fa00330f0078618bc3e149549c8170d32ec55890a7f9 -ec789f1f18ae92eb15d222af971d971c965af119acd0677368612d353132 +a7190109781c7461673a61726d2e636f6d2c323032333a7265616c6d2331 +2e302e300a58404142414241424142414241424142414241424142414241 +424142414241424142414241424142414241424142414241424142414241 +424142414241424142414219accb58404144414441444144414441444144 +414441444144414441444144414441444144414441444144414441444144 +414441444144414441444144414441444144414419acce58404343434343 +434343434343434343434343434343434343434343434343434343434343 +434343434343434343434343434343434343434343434343434343434319 +accc677368612d32353619accd58610481195880a2207fb956032a3cb97f +5da5af726ffcb715ee164784a7fb16c06096bdd9462a32650b2912a85515 +70d6ea1f3b2d1f7da8a275fa00330f0078618bc3e149549c8170d32ec558 +90a7f9ec789f1f18ae92eb15d222af971d971c965af119acd0677368612d +353132 ` // automatically generated from CcaClaimsMissingMandInitialMeas.diag var testEncodedCcaClaimsMissingMandInitialMeas = ` -a60a58404142414241424142414241424142414241424142414241424142 -414241424142414241424142414241424142414241424142414241424142 -414241424142414219accb58404144414441444144414441444144414441 -444144414441444144414441444144414441444144414441444144414441 -444144414441444144414441444144414419accf84584043434343434343 +a7190109781c7461673a61726d2e636f6d2c323032333a7265616c6d2331 +2e302e300a58404142414241424142414241424142414241424142414241 +424142414241424142414241424142414241424142414241424142414241 +424142414241424142414219accb58404144414441444144414441444144 +414441444144414441444144414441444144414441444144414441444144 +414441444144414441444144414441444144414419accf84584043434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343434343434343434343434343434343584043 434343434343434343434343434343434343434343434343434343434343 +584043434343434343434343434343434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343584043434343434343434343434343434343434343434343434343 +434343434343584043434343434343434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343584043434343434343434343434343434343434343 +434343434343434343434343584043434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -43434343434343434343434343434319accc677368612d32353619accd58 -610481195880a2207fb956032a3cb97f5da5af726ffcb715ee164784a7fb -16c06096bdd9462a32650b2912a8551570d6ea1f3b2d1f7da8a275fa0033 -0f0078618bc3e149549c8170d32ec55890a7f9ec789f1f18ae92eb15d222 -af971d971c965af119acd0677368612d353132 +43434343434343434343434343434343434319accc677368612d32353619 +accd58610481195880a2207fb956032a3cb97f5da5af726ffcb715ee1647 +84a7fb16c06096bdd9462a32650b2912a8551570d6ea1f3b2d1f7da8a275 +fa00330f0078618bc3e149549c8170d32ec55890a7f9ec789f1f18ae92eb +15d222af971d971c965af119acd0677368612d353132 ` // automatically generated from CcaRealmClaimsMissingMandNonce.diag var testEncodedCcaRealmClaimsMissingMandNonce = ` -a619accb5840414441444144414441444144414441444144414441444144 -414441444144414441444144414441444144414441444144414441444144 -4144414441444144414419acce5840434343434343434343434343434343 +a7190109781c7461673a61726d2e636f6d2c323032333a7265616c6d2331 +2e302e3019accb5840414441444144414441444144414441444144414441 +444144414441444144414441444144414441444144414441444144414441 +4441444144414441444144414419acce5840434343434343434343434343 +434343434343434343434343434343434343434343434343434343434343 +4343434343434343434343434343434343434343434319accf8458404343 434343434343434343434343434343434343434343434343434343434343 -4343434343434343434343434343434343434319accf8458404343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343434343434343434343434343434343434358 -404343434343434343434343434343434343434343434343434343434343 +434358404343434343434343434343434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434358404343434343434343434343434343434343434343434343 +434343434343434358404343434343434343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434358404343434343434343434343434343434343 +434343434343434343434343434358404343434343434343434343434343 434343434343434343434343434343434343434343434343434343434343 -434343434343434343434343434343434319accc677368612d32353619ac -cd58610481195880a2207fb956032a3cb97f5da5af726ffcb715ee164784 -a7fb16c06096bdd9462a32650b2912a8551570d6ea1f3b2d1f7da8a275fa -00330f0078618bc3e149549c8170d32ec55890a7f9ec789f1f18ae92eb15 -d222af971d971c965af119acd0677368612d353132 +434343434343434343434343434343434343434319accc677368612d3235 +3619accd58610481195880a2207fb956032a3cb97f5da5af726ffcb715ee +164784a7fb16c06096bdd9462a32650b2912a8551570d6ea1f3b2d1f7da8 +a275fa00330f0078618bc3e149549c8170d32ec55890a7f9ec789f1f18ae +92eb15d222af971d971c965af119acd0677368612d353132 ` // automatically generated from CcaClaimsMissingMandHashAlgID.diag var testEncodedCcaClaimsMissingMandHashAlgID = ` -a60a58404142414241424142414241424142414241424142414241424142 +a7190109781c7461673a61726d2e636f6d2c323032333a7265616c6d2331 +2e302e300a58404142414241424142414241424142414241424142414241 +424142414241424142414241424142414241424142414241424142414241 +424142414241424142414219accb58404144414441444144414441444144 +414441444144414441444144414441444144414441444144414441444144 +414441444144414441444144414441444144414419acce58404343434343 +434343434343434343434343434343434343434343434343434343434343 +434343434343434343434343434343434343434343434343434343434319 +accf84584043434343434343434343434343434343434343434343434343 +434343434343434343434343434343434343434343434343434343434343 +434343434343434343584043434343434343434343434343434343434343 +434343434343434343434343434343434343434343434343434343434343 +434343434343434343434343434343584043434343434343434343434343 +434343434343434343434343434343434343434343434343434343434343 +434343434343434343434343434343434343434343584043434343434343 +434343434343434343434343434343434343434343434343434343434343 +43434343434343434343434343434343434343434343434343434319accd +58610481195880a2207fb956032a3cb97f5da5af726ffcb715ee164784a7 +fb16c06096bdd9462a32650b2912a8551570d6ea1f3b2d1f7da8a275fa00 +330f0078618bc3e149549c8170d32ec55890a7f9ec789f1f18ae92eb15d2 +22af971d971c965af119acd0677368612d353132 +` + +// automatically generated from CcaRealmExample.diag +var testEncodedCcaRealmExample = ` +a8190109781c7461673a61726d2e636f6d2c323032333a7265616c6d2331 +2e302e300a58406e86d6d97cc713bc6dd43dbce491a6b40311c027a8bf85 +a39da63e9ce44c132a8a119d296fae6a6999e9bf3e4471b0ce01245d8894 +24c31e89793b3b1d6b150419accc677368612d32353619acd0677368612d +32353619accb584054686520717569636b2062726f776e20666f78206a75 +6d7073206f766572203133206c617a7920646f67732e5468652071756963 +6b2062726f776e20666f782019accd586ba40102200221583076f988091b +e585ed41801aecfab858548c63057e16b0e676120bbd0d2f9c29e056c5d4 +1a0130eb9c21517899dc23146b22583028e1b062bd3ea4b315fd219f1cbb +528cb6e74ca49be16773734f61a1ca61031b2bbf3d918f2f94ffc4228e50 +919544ae19acce5820311314ab73620350cf758834ae5c65d9e8c2dc7feb +e6e7d9654bbe864e300d4919accf84582024d5b0a296cc05cbd8068c5067 +c5bd473b770dda6ae082fe3ba30abe3f9a6ab15820788fc090bfc6b8ed90 +3152ba8414e73daf5b8c7bb1e79ad502ab0699b659ed165820dac46a5841 +5dc3a00d7a741852008e9cae64f52d03b9f76d76f4b3644fefc416582032 +c6afc627e55585c03155359f331a0e225f6840db947dd96efab81be26719 +39 +` + +// automatically generated from CcaRealmLegacyClaimsAll.diag +var testEncodedCcaRealmLegacyClaimsAll = ` +a70a58404142414241424142414241424142414241424142414241424142 414241424142414241424142414241424142414241424142414241424142 414241424142414219accb58404144414441444144414441444144414441 444144414441444144414441444144414441444144414441444144414441 @@ -121,9 +174,9 @@ a60a58404142414241424142414241424142414241424142414241424142 434343434343434343434343434343434343434343434343434343434343 434343434343434343434343434343434343584043434343434343434343 434343434343434343434343434343434343434343434343434343434343 -43434343434343434343434343434343434343434343434319accd586104 -81195880a2207fb956032a3cb97f5da5af726ffcb715ee164784a7fb16c0 -6096bdd9462a32650b2912a8551570d6ea1f3b2d1f7da8a275fa00330f00 -78618bc3e149549c8170d32ec55890a7f9ec789f1f18ae92eb15d222af97 -1d971c965af119acd0677368612d353132 +43434343434343434343434343434343434343434343434319accc677368 +612d32353619accd58610481195880a2207fb956032a3cb97f5da5af726f +fcb715ee164784a7fb16c06096bdd9462a32650b2912a8551570d6ea1f3b +2d1f7da8a275fa00330f0078618bc3e149549c8170d32ec55890a7f9ec78 +9f1f18ae92eb15d222af971d971c965af119acd0677368612d353132 ` diff --git a/realm/test_common.go b/realm/test_common.go index e454808..aeded51 100644 --- a/realm/test_common.go +++ b/realm/test_common.go @@ -34,6 +34,18 @@ var ( 0x92, 0xeb, 0x15, 0xd2, 0x22, 0xaf, 0x97, 0x1d, 0x97, 0x1c, 0x96, 0x5a, 0xf1, } + + testRAKPubCOSE = []byte{ + 0xa4, 0x01, 0x02, 0x20, 0x02, 0x21, 0x58, 0x30, 0x76, 0xf9, 0x88, 0x09, + 0x1b, 0xe5, 0x85, 0xed, 0x41, 0x80, 0x1a, 0xec, 0xfa, 0xb8, 0x58, 0x54, + 0x8c, 0x63, 0x05, 0x7e, 0x16, 0xb0, 0xe6, 0x76, 0x12, 0x0b, 0xbd, 0x0d, + 0x2f, 0x9c, 0x29, 0xe0, 0x56, 0xc5, 0xd4, 0x1a, 0x01, 0x30, 0xeb, 0x9c, + 0x21, 0x51, 0x78, 0x99, 0xdc, 0x23, 0x14, 0x6b, 0x22, 0x58, 0x30, 0x28, + 0xe1, 0xb0, 0x62, 0xbd, 0x3e, 0xa4, 0xb3, 0x15, 0xfd, 0x21, 0x9f, 0x1c, + 0xbb, 0x52, 0x8c, 0xb6, 0xe7, 0x4c, 0xa4, 0x9b, 0xe1, 0x67, 0x73, 0x73, + 0x4f, 0x61, 0xa1, 0xca, 0x61, 0x03, 0x1b, 0x2b, 0xbf, 0x3d, 0x91, 0x8f, + 0x2f, 0x94, 0xff, 0xc4, 0x22, 0x8e, 0x50, 0x91, 0x95, 0x44, 0xae, + } ) func mustHexDecode(t *testing.T, s string) []byte { diff --git a/realm/testvectors/cbor/CcaClaimsMissingMandExtendedMeas.diag b/realm/testvectors/cbor/CcaClaimsMissingMandExtendedMeas.diag index 935bb1a..58f8c4c 100644 --- a/realm/testvectors/cbor/CcaClaimsMissingMandExtendedMeas.diag +++ b/realm/testvectors/cbor/CcaClaimsMissingMandExtendedMeas.diag @@ -1,4 +1,5 @@ { + 265: "tag:arm.com,2023:realm#1.0.0", 10: h'41424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142', 44235: h'41444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144', 44238: h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', diff --git a/realm/testvectors/cbor/CcaClaimsMissingMandHashAlgID.diag b/realm/testvectors/cbor/CcaClaimsMissingMandHashAlgID.diag index 7962d3d..02f5058 100644 --- a/realm/testvectors/cbor/CcaClaimsMissingMandHashAlgID.diag +++ b/realm/testvectors/cbor/CcaClaimsMissingMandHashAlgID.diag @@ -1,4 +1,5 @@ { + 265: "tag:arm.com,2023:realm#1.0.0", 10: h'41424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142', 44235: h'41444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144', 44238: h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', diff --git a/realm/testvectors/cbor/CcaClaimsMissingMandInitialMeas.diag b/realm/testvectors/cbor/CcaClaimsMissingMandInitialMeas.diag index 370db69..7f55f1a 100644 --- a/realm/testvectors/cbor/CcaClaimsMissingMandInitialMeas.diag +++ b/realm/testvectors/cbor/CcaClaimsMissingMandInitialMeas.diag @@ -1,4 +1,5 @@ { + 265: "tag:arm.com,2023:realm#1.0.0", 10: h'41424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142', 44235: h'41444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144', 44239: [ diff --git a/realm/testvectors/cbor/CcaClaimsMissingMandPubKey.diag b/realm/testvectors/cbor/CcaClaimsMissingMandPubKey.diag index ecf81a7..4d81089 100644 --- a/realm/testvectors/cbor/CcaClaimsMissingMandPubKey.diag +++ b/realm/testvectors/cbor/CcaClaimsMissingMandPubKey.diag @@ -1,4 +1,5 @@ { + 265: "tag:arm.com,2023:realm#1.0.0", 10: h'41424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142', 44235: h'41444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144', 44238: h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', diff --git a/realm/testvectors/cbor/CcaRealmClaimsAll.diag b/realm/testvectors/cbor/CcaRealmClaimsAll.diag index c7bb09e..01e4441 100644 --- a/realm/testvectors/cbor/CcaRealmClaimsAll.diag +++ b/realm/testvectors/cbor/CcaRealmClaimsAll.diag @@ -1,4 +1,5 @@ { + 265: "tag:arm.com,2023:realm#1.0.0", 10: h'41424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142', 44235: h'41444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144', 44238: h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', @@ -9,6 +10,6 @@ h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343' ], 44236: "sha-256", - 44237: h'0481195880a2207fb956032a3cb97f5da5af726ffcb715ee164784a7fb16c06096bdd9462a32650b2912a8551570d6ea1f3b2d1f7da8a275fa00330f0078618bc3e149549c8170d32ec55890a7f9ec789f1f18ae92eb15d222af971d971c965af1', + 44237: h'A40102200221583076F988091BE585ED41801AECFAB858548C63057E16B0E676120BBD0D2F9C29E056C5D41A0130EB9C21517899DC23146B22583028E1B062BD3EA4B315FD219F1CBB528CB6E74CA49BE16773734F61A1CA61031B2BBF3D918F2F94FFC4228E50919544AE', 44240: "sha-512" } diff --git a/realm/testvectors/cbor/CcaRealmClaimsMissingMandNonce.diag b/realm/testvectors/cbor/CcaRealmClaimsMissingMandNonce.diag index 0506c71..41992a6 100644 --- a/realm/testvectors/cbor/CcaRealmClaimsMissingMandNonce.diag +++ b/realm/testvectors/cbor/CcaRealmClaimsMissingMandNonce.diag @@ -1,4 +1,5 @@ { + 265: "tag:arm.com,2023:realm#1.0.0", 44235: h'41444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144', 44238: h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', 44239: [ diff --git a/realm/testvectors/cbor/CcaRealmExample.diag b/realm/testvectors/cbor/CcaRealmExample.diag new file mode 100644 index 0000000..079318a --- /dev/null +++ b/realm/testvectors/cbor/CcaRealmExample.diag @@ -0,0 +1,20 @@ +{ + 265: "tag:arm.com,2023:realm#1.0.0", / eat_profile / + 10: h'6E86D6D97CC713BC6DD43DBCE491A6B40311C027A8BF85A39DA63E9CE44C132A8A119D296FAE6A6999E9BF3E4471B0CE01245D889424C31E89793B3B1D6B1504', / eat_nonce / + 44236: "sha-256", / Realm hash algorithm / + 44240: "sha-256", / RAK hash algorithm / + 44235: h'54686520717569636B2062726F776E20666F78206A756D7073206F766572203133206C617A7920646F67732E54686520717569636B2062726F776E20666F7820', / PV / + 44237: << { / RAK / + 1: 2, / kty=EC2 / + -1: 2, / crv=P-384 / + -2: h'76F988091BE585ED41801AECFAB858548C63057E16B0E676120BBD0D2F9C29E056C5D41A0130EB9C21517899DC23146B', / x-coordinate / + -3: h'28E1B062BD3EA4B315FD219F1CBB528CB6E74CA49BE16773734F61A1CA61031B2BBF3D918F2F94FFC4228E50919544AE' / y-coordinate / + } >>, + 44238: h'311314AB73620350CF758834AE5C65D9E8C2DC7FEBE6E7D9654BBE864E300D49', / RIM / + 44239: [ + h'24D5B0A296CC05CBD8068C5067C5BD473B770DDA6AE082FE3BA30ABE3F9A6AB1', / REM[0] / + h'788FC090BFC6B8ED903152BA8414E73DAF5B8C7BB1E79AD502AB0699B659ED16', / REM[1] / + h'DAC46A58415DC3A00D7A741852008E9CAE64F52D03B9F76D76F4B3644FEFC416', / REM[2] / + h'32C6AFC627E55585C03155359F331A0E225F6840DB947DD96EFAB81BE2671939' / REM[3] / + ] +} diff --git a/realm/testvectors/cbor/CcaRealmLegacyClaimsAll.diag b/realm/testvectors/cbor/CcaRealmLegacyClaimsAll.diag new file mode 100644 index 0000000..c7bb09e --- /dev/null +++ b/realm/testvectors/cbor/CcaRealmLegacyClaimsAll.diag @@ -0,0 +1,14 @@ +{ + 10: h'41424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142414241424142', + 44235: h'41444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144414441444144', + 44238: h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', + 44239: [ + h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', + h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', + h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343', + h'43434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343' + ], + 44236: "sha-256", + 44237: h'0481195880a2207fb956032a3cb97f5da5af726ffcb715ee164784a7fb16c06096bdd9462a32650b2912a8551570d6ea1f3b2d1f7da8a275fa00330f0078618bc3e149549c8170d32ec55890a7f9ec789f1f18ae92eb15d222af971d971c965af1', + 44240: "sha-512" +} diff --git a/realm/testvectors/cbor/Makefile b/realm/testvectors/cbor/Makefile new file mode 100644 index 0000000..fd26097 --- /dev/null +++ b/realm/testvectors/cbor/Makefile @@ -0,0 +1,13 @@ +# NOTE: the notion of which test vectors will be built is encoded in +# build-test-vectors.sh + +OUTPUT := ../../pretty_test_vectors.go + +DEPS := $(wildcard *.diag) + +all: $(OUTPUT) + +$(OUTPUT): $(DEPS) + env TV_DOT_GO=$(OUTPUT) ./build-test-vectors.sh + +clean: ; $(RM) $(OUTPUT) diff --git a/realm/testvectors/cbor/build-test-vectors.sh b/realm/testvectors/cbor/build-test-vectors.sh index 74c8b8f..9bcfdb4 100755 --- a/realm/testvectors/cbor/build-test-vectors.sh +++ b/realm/testvectors/cbor/build-test-vectors.sh @@ -12,10 +12,12 @@ DIAG_FILES="${DIAG_FILES} CcaClaimsMissingMandExtendedMeas" DIAG_FILES="${DIAG_FILES} CcaClaimsMissingMandInitialMeas" DIAG_FILES="${DIAG_FILES} CcaRealmClaimsMissingMandNonce" DIAG_FILES="${DIAG_FILES} CcaClaimsMissingMandHashAlgID" +DIAG_FILES="${DIAG_FILES} CcaRealmExample" +DIAG_FILES="${DIAG_FILES} CcaRealmLegacyClaimsAll" TV_DOT_GO=${TV_DOT_GO?must be set in the environment.} -printf "package ccatoken \n\n" > ${TV_DOT_GO} +printf "package realm \n\n" > ${TV_DOT_GO} for t in ${DIAG_FILES} do