mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
4df0781989
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
131 lines
4.0 KiB
Groff
131 lines
4.0 KiB
Groff
.\" Copyright 2024 IBM Corp.
|
|
.\" s390-tools is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the MIT license. See LICENSE for details.
|
|
.\"
|
|
|
|
.TH pvattest-create 1 "2024-12-05" "s390-tools" "Attestation Manual"
|
|
.nh
|
|
.ad l
|
|
.SH NAME
|
|
\fBpvattest create\fP - Create an attestation measurement request
|
|
\fB
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.fam C
|
|
pvattest create [OPTIONS] --host-key-document <FILE> --output <FILE> --arpk <FILE> <--no-verify|--cert <FILE>>
|
|
.fam C
|
|
.fi
|
|
.SH DESCRIPTION
|
|
Create attestation measurement requests to attest an IBM Secure Execution guest.
|
|
Only build attestation requests in a trusted environment such as your
|
|
Workstation. To avoid compromising the attestation do not publish the
|
|
attestation request protection key and shred it after verification. Every
|
|
'create' will generate a new, random protection key.
|
|
.SH OPTIONS
|
|
.PP
|
|
\-k, \-\-host-key-document <FILE>
|
|
.RS 4
|
|
Use FILE as a host-key document. Can be specified multiple times and must be
|
|
specified at least once.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-no-verify
|
|
.RS 4
|
|
Disable the host-key document verification. Does not require the host-key
|
|
documents to be valid. Do not use for a production request unless you verified
|
|
the host-key document beforehand.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-C, \-\-cert <FILE>
|
|
.RS 4
|
|
Use FILE as a certificate to verify the host-key or keys. The certificates are
|
|
used to establish a chain of trust for the verification of the host-key
|
|
documents. Specify this option twice to specify the IBM Z signing key and the
|
|
intermediate CA certificate (signed by the root CA).
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-crl <FILE>
|
|
.RS 4
|
|
Use FILE as a certificate revocation list (CRL). The list is used to check
|
|
whether a certificate of the chain of trust is revoked. Specify this option
|
|
multiple times to use multiple CRLs.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-offline
|
|
.RS 4
|
|
Make no attempt to download CRLs.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-root-ca <ROOT_CA>
|
|
.RS 4
|
|
Use FILE as the root-CA certificate for the verification. If omitted, the system
|
|
wide-root CAs installed on the system are used. Use this only if you trust the
|
|
specified certificate.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-o, \-\-output <FILE>
|
|
.RS 4
|
|
Write the generated request to FILE.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-a, \-\-arpk <FILE>
|
|
.RS 4
|
|
Save the protection key as unencrypted GCM-AES256 key in FILE Do not publish
|
|
this key, otherwise your attestation is compromised.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-add-data <FLAGS>
|
|
.RS 4
|
|
Specify additional data for the request. Additional data is provided by the
|
|
Ultravisor and returned during the attestation request and is covered by the
|
|
attestation measurement. Can be specified multiple times. Optional.
|
|
|
|
Possible values:
|
|
.RS 4
|
|
- \fBphkh-img\fP: Request the public host-key-hash of the key that decrypted the SE-image as additional-data.
|
|
|
|
- \fBphkh-att\fP: Request the public host-key-hash of the key that decrypted the attestation request as additional-data.
|
|
|
|
- \fBsecret-store-hash\fP: Request a hash over all successful Add-secret requests and the lock state as additional-data.
|
|
|
|
- \fBfirmware-state\fP: Request the state of the firmware as additional-data.
|
|
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-h, \-\-help
|
|
.RS 4
|
|
Print help (see a summary with '-h').
|
|
.RE
|
|
.RE
|
|
|
|
.SH EXAMPLES
|
|
Create an attestation request with the protection key 'arp.key', write the request to 'arcb.bin', and verify the host-key document using the CA-signed key 'DigiCertCA.crt' and the intermediate key 'IbmSigningKey.crt'.
|
|
.PP
|
|
.nf
|
|
.fam C
|
|
$ pvattest create \-k hkd.crt -\-\arpk arp.key \-o attreq.bin \-\-cert DigiCertCA.crt \-\-cert IbmSigningKey.crt
|
|
|
|
.fam T
|
|
.fi
|
|
Create an attestation request with the protection key 'arp.key', write the request to 'arcb.bin', verify the host-key document using the CA-signed key 'DigiCertCA.crt' and the intermediate key 'IbmSigningKey.crt', and instead of downloading the certificate revocation list use certificate revocation lists 'DigiCertCA.crl', 'IbmSigningKey.crl', and 'rootCA.crl'.
|
|
.PP
|
|
.nf
|
|
.fam C
|
|
$ pvattest create \-k hkd.crt \-\-arpk arp.key \-o attreq.bin \-\-cert DigiCertCA.crt \-\-cert IbmSigningKey.crt \-\-offline \-\-crl DigiCertCA.crl \-\-crl IbmSigningKey.crl \-\-crl rootCA.crl
|
|
|
|
|
|
.fam T
|
|
.fi
|
|
.SH "SEE ALSO"
|
|
.sp
|
|
\fBpvattest\fR(1)
|