mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
Steffen Eiden
16610a211f
Add a CLI compatible Rust implementation of pvattest-C. - All (non-experimental) options are supported and work exactly as in the C implementation. For some options/parameters new variants are available. - `perform` now also accepts positional arguments, while keep accepting -i and -o that was mandatory in the C implementation. - `version` may also be a command instead of an option now. - -V is deprecated - -v increases verbosity instead of showing the version - all experimental options are dropped Acked-by: Qi Feng Huo <huoqif@cn.ibm.com> Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
115 lines
2.1 KiB
Groff
115 lines
2.1 KiB
Groff
.\" Copyright 2024 IBM Corp.
|
||
.\" s390-tools is free software; you can redistribute it and/or modify
|
||
.\" it under the terms of the MIT license. See LICENSE for details.
|
||
.\"
|
||
|
||
.TH pvattest 1 "2024-05-15" "s390-tools" "Attestation Manual"
|
||
.nh
|
||
.ad l
|
||
.SH NAME
|
||
\fBpvattest\fP - create, perform, and verify attestation measurements
|
||
\fB
|
||
.SH SYNOPSIS
|
||
.nf
|
||
.fam C
|
||
pvattest [OPTIONS] <COMMAND>
|
||
.fam C
|
||
.fi
|
||
.SH DESCRIPTION
|
||
Create, perform, and verify attestation measurements for IBM Secure Execution
|
||
guest systems.
|
||
.SH "PVATTEST COMMANDS"
|
||
.PP
|
||
|
||
\fBcreate\fR
|
||
.RS 4
|
||
Create an attestation measurement request
|
||
.RE
|
||
|
||
.PP
|
||
|
||
\fBperform\fR
|
||
.RS 4
|
||
Send the attestation request to the Ultravisor
|
||
.RE
|
||
|
||
.PP
|
||
|
||
\fBverify\fR
|
||
.RS 4
|
||
Verify an attestation response
|
||
.RE
|
||
|
||
.PP
|
||
|
||
\fBversion\fR
|
||
.RS 4
|
||
Print version information and exit
|
||
.RE
|
||
|
||
.SH OPTIONS
|
||
.PP
|
||
\-v, \-\-verbose
|
||
.RS 4
|
||
Provide more detailed output.
|
||
.RE
|
||
.RE
|
||
.PP
|
||
\-\-version
|
||
.RS 4
|
||
Print version information and exit.
|
||
.RE
|
||
.RE
|
||
.PP
|
||
\-h, \-\-help
|
||
.RS 4
|
||
Print help (see a summary with '-h').
|
||
.RE
|
||
.RE
|
||
|
||
.SH EXAMPLES
|
||
For details refer to the man page of the command.
|
||
.PP
|
||
Create the request on a trusted system.
|
||
.PP
|
||
.nf
|
||
.fam C
|
||
trusted:~$ pvattest create \-k hkd.crt \-\-cert CA.crt \-\-cert ibmsk.crt \-\-arpk arp.key \-o attreq.bin
|
||
|
||
.fam T
|
||
.fi
|
||
On the SE-guest, \fIperform\fP the attestation.
|
||
.PP
|
||
.nf
|
||
.fam C
|
||
seguest:~$ pvattest perform attreq.bin attresp.bin
|
||
|
||
.fam T
|
||
.fi
|
||
On a trusted system, \fIverify\fP that the response is correct. Here, the protection key from the creation and the SE-guest’s header is used to \fIverify\fP the measurement.
|
||
.PP
|
||
.nf
|
||
.fam C
|
||
trusted:~$ pvattest verify \-i attresp.bin \-\-arpk arp.key \-\-hdr se_guest.hdr
|
||
trusted:~$ echo $?
|
||
0
|
||
|
||
.fam T
|
||
.fi
|
||
|
||
If the measurements do not match \fBpvattest\fP exits with code 2 and emits an error message. The SE-guest attestation failed.
|
||
.PP
|
||
.nf
|
||
.fam C
|
||
trusted:~$ pvattest verify \-i wrongresp.bin \-\-arpk arp.key \-\-hdr se_guest.hdr
|
||
ERROR: Attestation measurement verification failed:
|
||
Calculated and received attestation measurement are not the same.
|
||
trusted:~$ echo $?
|
||
2
|
||
|
||
.fam T
|
||
.fi
|
||
.SH "SEE ALSO"
|
||
.sp
|
||
\fBpvattest-create\fR(1) \fBpvattest-perform\fR(1) \fBpvattest-verify\fR(1)
|