mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
3ab06d77fb
pvattest is a tool to attest an IBM Secure Execution guest. In a trusted environment, one can create a request using `pvattest create`. To get a measurement of an untrusted IBM Secure Execution guest call 'pvattest perform'. Again in a trusted environment, call 'pvattest verify' to verify that the measurement is the expected one. The tool runs on s390 and x86. It has the same requirements like libpv and therefore requires openssl v1.1.1+, glib2.56+, and libcurl. Additionally, to measure, the linux kernel must provide the Ultravisor userspace interface `uvdevice` at /dev/uv and must be executed on an IBM Secure Execution guest on hardware with Ultravisor attestation support, like IBM z16 or later. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
100 lines
3.2 KiB
C
100 lines
3.2 KiB
C
/*
|
||
* Attestation related functions and definitions.
|
||
*
|
||
* Copyright IBM Corp. 2022
|
||
*
|
||
* s390-tools is free software; you can redistribute it and/or modify
|
||
* it under the terms of the MIT license. See LICENSE for details.
|
||
*/
|
||
#ifndef PVATTEST_ATTESTATION_H
|
||
#define PVATTEST_ATTESTATION_H
|
||
/* Must be included before any other header */
|
||
#include "config.h"
|
||
|
||
#include <openssl/sha.h>
|
||
|
||
#include "libpv/glib-helper.h"
|
||
#include "libpv/crypto.h"
|
||
#include "libpv/cert.h"
|
||
|
||
#include "common.h"
|
||
#include "types.h"
|
||
#include "arcb.h"
|
||
|
||
#define ATT_CONFIG_UID_SIZE 16
|
||
|
||
typedef struct {
|
||
uint8_t pld[SHA512_DIGEST_LENGTH];
|
||
uint8_t ald[SHA512_DIGEST_LENGTH];
|
||
uint8_t tld[SHA512_DIGEST_LENGTH];
|
||
uint8_t tag[AES_256_GCM_TAG_SIZE];
|
||
uint8_t config_uid[ATT_CONFIG_UID_SIZE];
|
||
} __packed att_meas_ctx_t;
|
||
G_STATIC_ASSERT(sizeof(att_meas_ctx_t) == 224);
|
||
|
||
/**
|
||
* att_gen_measurement_hmac_sha512:
|
||
*
|
||
* @meas_ctx: measurement context.
|
||
* @measurement_key: AES-256-GCM key for generating the measurement calculation.
|
||
* @optional_user_data: NULL or up to 256 bytes GBytes.
|
||
* @optional_nonce: NULL or a nonce of exactly `ARCB_V1_NONCE_SIZE` bytes
|
||
* @optional_additional_data: NULL or up to 0x8000 bytes of GBytes.
|
||
* @error: GError. *error will != NULL if error occurs.
|
||
*
|
||
* Calculates the measurement value.
|
||
* If the input data is the same which the UV used in the Retrieve Attestation Measurement
|
||
* the result should be identical to the data in the ´Measurement Data Address´ UVC.
|
||
*
|
||
* Returns: (nullable) (transfer full): a hmac_sha512 of the given data.
|
||
*/
|
||
GBytes *att_gen_measurement_hmac_sha512(const att_meas_ctx_t *meas_ctx, GBytes *measurement_key,
|
||
GBytes *optional_user_data, GBytes *optional_nonce,
|
||
GBytes *optional_additional_data, GError **error)
|
||
PV_NONNULL(1, 2);
|
||
|
||
/**
|
||
* att_extract_from_hdr:
|
||
*
|
||
* @se_hdr: binary SE guest header.
|
||
* @error: GError. *error will != NULL if error occurs.
|
||
*
|
||
* Verifies that SE header size and magic ,but no cryptographical verification.
|
||
* Then, find and extracts pld, ald, tld, and SE tagi and adds it to the context.
|
||
*
|
||
* Returns: new attestation measurement context.
|
||
*/
|
||
att_meas_ctx_t *att_extract_from_hdr(GBytes *se_hdr, GError **error) PV_NONNULL(1);
|
||
|
||
/** att_add_uid:
|
||
*
|
||
* @meas_ctx: measurement context.
|
||
* @config_uid: pointer to config UID. Must be `ATT_CONFIG_UID_SIZE` bytes long.
|
||
*
|
||
* Copies the config UID to the measurement context.
|
||
* Wrong size is considered as a Programming error.
|
||
*/
|
||
void att_add_uid(att_meas_ctx_t *meas_ctx, GBytes *config_uid) PV_NONNULL(1, 2);
|
||
|
||
/** att_verify_measurement:
|
||
*
|
||
* @calculated_measurement: measurement calculated by a trusted system
|
||
* @uvio_measurement: measurement generated by an UV
|
||
* @error: GError. *error will != NULL if error occurs.
|
||
*
|
||
* Returns: TRUE if measurements are identical, otherwise FALSE
|
||
*/
|
||
gboolean att_verify_measurement(const GBytes *calculated_measurement,
|
||
const GBytes *uvio_measurement, GError **error) PV_NONNULL(1, 2);
|
||
|
||
#define ATT_ERROR g_quark_from_static_string("pv-att_error-quark")
|
||
typedef enum att_error {
|
||
ATT_ERR_INVALID_HDR,
|
||
ATT_ERR_INVALID_USER_DATA,
|
||
ATT_ERR_MEASUREMENT_VERIFICATION_FAILED,
|
||
ATT_ERR_PHKH_NO_FIT_IN_USER_DATA,
|
||
ATT_ERR_PHKH_NO_MATCH,
|
||
} att_error_e;
|
||
|
||
#endif /* PVATTEST_ATTESTATION_H */
|