trustee
trustee copied to clipboard
Verifier: Add IBM Secure Execution driver framework
Fixes: #342 This is kbs side code and related with PR: https://github.com/confidential-containers/guest-components/pull/492/ Depends on:
- [x] https://github.com/virtee/kbs-types/issues/26
The IBM SE Remote Attestation flow:
- The verifier generate the encrypted attestation-request based on hkd, CA, signing_key, a measurement key and a nonce, the encrypted data is protected by a symmetric attestation request protection key, which is encrypted using the Host-key document
- Verifier sends the request to attester
- Firmware on the Attester's system decrypts the request via private host-key and calculates the evidence based on the encrpted part of the request (Measurement key + nonce)
- Attester send the evidence to verifier
- Verifier recalculates the evidence based on the Configuration UID, Additional data, user-data, guest image hashes, and nonce. (its a HMAC-SHA512 with the measurement key as secret)
- if both HMACs, the one from the Firmware and the calculated one from the verifier match -> attestation success