remote-attest-01: Azure confidential VM TDX evidence (azure-tdx) and Intel Trust Authority tokens (ita)

CHANGELOG.md

@@ -49,6 +49,27 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
   account and the EAB key it was created with, is sent to webhooks as
   `attestation` and given to templates as `.Attestation`. The challenge can be
   configured in `ca.json` only for now.
+- An `azure-tdx` format for `remote-attest-01`, for Azure confidential VMs with
+  Intel TDX, whose guests cannot get a TDX quote themselves. The evidence
+  (`application/vnd.smallstep.azure-tdx+json`) is the quote of the paravisor's
+  TD report and the runtime claims document its report data commits to; the
+  binding and the relying party's nonce are the 64 bytes of `user-data` in
+  those claims. The quote's MRTD measures Azure's paravisor, so the format is
+  accepted only when listed in `formats`, and the runtime claims (the vTPM's
+  `HCLAkPub` key and the VM configuration) are given to webhooks and templates
+  as `.Attestation.azureRuntime`.
+- An `ita` format for `remote-attest-01`: tokens Intel Trust Authority issues
+  for Intel TDX trust domains, including Azure confidential VMs, sent as
+  `application/eat+jwt` and told from Confidential Space tokens by their
+  issuer. step-ca verifies the token with the signing key its `kid` names,
+  fetched from Intel Trust Authority's key set, whose certificate chain must
+  verify to Intel Trust Authority's root, which step-ca embeds; the binding
+  and the relying party's nonce are the 64 bytes of `attester_user_data`, and
+  the runtime data the TD quote committed to must be SHA-512 of the verifier
+  nonce, if any, and that user data. Debuggable trust domains are refused. The
+  token's claims, including the vTPM PCRs Intel Trust Authority appraised on
+  Azure, are given to webhooks and templates as `.Attestation.ita`. It is
+  configured by `remoteAttestation.ita`.
 - The `attestation` package and its subpackages, which verify TDX quotes,
   SEV-SNP reports and Confidential Space tokens, and parse CMW records and
   configfs-tsm reports. The `device-attest-01` formats' verifiers (`apple`,

attestation/attestation.go

@@ -27,20 +27,28 @@ const (
 	// FormatConfidentialSpace is a Google Cloud Attestation token for a
 	// Confidential Space workload.
 	FormatConfidentialSpace Format = "confidential-space"
+	// FormatAzureTDX is an Intel TDX quote from an Azure confidential VM
+	// whose paravisor reports for the guest, with the runtime claims the
+	// quote commits to.
+	FormatAzureTDX Format = "azure-tdx"
+	// FormatITA is an Intel Trust Authority token for an Intel TDX trust
+	// domain.
+	FormatITA Format = "ita"
 )
 
 // Validate returns an error if the format is not supported.
 func (f Format) Validate() error {
 	switch f {
-	case FormatTDX, FormatSEVSNP, FormatConfidentialSpace:
+	case FormatTDX, FormatSEVSNP, FormatConfidentialSpace, FormatAzureTDX, FormatITA:
 		return nil
 	default:
 		return fmt.Errorf("attestation format %q is not supported", f)
 	}
 }
 
 // Result is verified attestation evidence. Binary values are hex encoded.
-// Exactly one of TDX, SEVSNP and ConfidentialSpace is set, as Format says.
+// Exactly one of TDX, SEVSNP, ConfidentialSpace and ITA is set, as Format says;
+// for FormatAzureTDX, TDX and AzureRuntime are both set.
 type Result struct {
 	// Format is the format of the evidence.
 	Format Format `json:"format"`
@@ -52,6 +60,32 @@ type Result struct {
 	TDX               *TDX               `json:"tdx,omitempty"`
 	SEVSNP            *SEVSNP            `json:"sevSnp,omitempty"`
 	ConfidentialSpace *ConfidentialSpace `json:"confidentialSpace,omitempty"`
+	AzureRuntime      *AzureRuntime      `json:"azureRuntime,omitempty"`
+	ITA               *ITA               `json:"ita,omitempty"`
+}
+
+// ITA holds the claims of a verified Intel Trust Authority token. On an Azure
+// confidential VM they include the vTPM's PCRs, which Intel Trust Authority
+// appraised, under tpm.pcrs.
+type ITA struct {
+	// Claims are all the claims of the token.
+	Claims map[string]any `json:"claims"`
+	// SignerSerialNumber is the serial number of the certificate of the key
+	// that signed the token.
+	SignerSerialNumber string `json:"signerSerialNumber,omitempty"`
+}
+
+// AzureRuntime holds the runtime claims of an Azure confidential VM, which the
+// report data of its paravisor's TDX quote commits to. On these VMs the quote's
+// MRTD measures the paravisor and its RTMRs are zero: the guest is measured in
+// the vTPM's PCRs, and HCLAkPub signs quotes of them.
+type AzureRuntime struct {
+	// Keys are the vTPM's keys as JWKs, identified by kid: HCLAkPub, its
+	// attestation key, and HCLEkPub.
+	Keys []map[string]any `json:"keys"`
+	// VMConfiguration is the VM's configuration, for example secure-boot,
+	// console-enabled and vmUniqueId.
+	VMConfiguration map[string]any `json:"vmConfiguration"`
 }
 
 // TDX holds the measurements and attributes of a verified Intel TDX quote.

attestation/ita/intel_trust_authority_root.crt

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE2TCCA0GgAwIBAgIUCN/QtoirX6FtEcYfvLyRYaIuXpMwDQYJKoZIhvcNAQEN
+BQAwdDEmMCQGA1UEAwwdSW50ZWwgVHJ1c3QgQXV0aG9yaXR5IFJvb3QgQ0ExCzAJ
+BgNVBAYTAlVTMQswCQYDVQQIDAJDQTEUMBIGA1UEBwwLU2FudGEgQ2xhcmExGjAY
+BgNVBAoMEUludGVsIENvcnBvcmF0aW9uMB4XDTI0MTEyNzExNTE0MVoXDTQ5MTIz
+MDExNTE0MVowdDEmMCQGA1UEAwwdSW50ZWwgVHJ1c3QgQXV0aG9yaXR5IFJvb3Qg
+Q0ExCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEUMBIGA1UEBwwLU2FudGEgQ2xh
+cmExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMIIBojANBgkqhkiG9w0BAQEF
+AAOCAY8AMIIBigKCAYEAuQ1g1Q4MtnvTRhYITKVou5CDvB5FpfjBe8ssUKaDILwk
+gJlGNv66IWPQ9vhIekZQjuvHbUj9yPcrM7Hva7h7Ehlo/Sm7ZhY8AgZfGFTRJjvN
+U+vg/BTr5vuqUu/a54eewyzMcmxwmWhK/4cGQs7spFB346jpjSgOHgk5PgJ39PgE
+r5UL9SvJ1LFRuCNxZTdzyLe7K8cWvEnwGkR2RJpK9pYgzfnAWy8J0djdAKaoQxt8
+TOE/IwafG/0ujTeuNbzo+3wxeF6SGz56MimE1+KgraPpULaeX2tAL9lUz+ECMetN
+LbAyqHQwxN1jQZ/3VgpQ8qqh7Cyo4rEjpja29iRtOihBYlW0/X6TxOG1LLSuGo/N
+9CcSW6EzjsC1Bzakzjs4OD+JGaqqvc255p8URTxZSRSJr1xtimZK+BJoCHECsrCL
+vCC5UmFfTQrxkeGJ+OIDMkQFgidUw2K7kYXe9k7glKw9yyVf9C0hhqBFfPD8r+CX
+EA9m2u1tvR4NGMuoegMxAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFPMLB1WJSkb0GNbafK74Mj53qBYRMB8GA1UdIwQYMBaAFPMLB1WJSkb0GNba
+fK74Mj53qBYRMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQ0FAAOCAYEANqZT
+62Z7J4AqJeuBpkYYZji3a4imyoJnQN+vuuPS9x0BTsPdTo4WqV0sHIwRrmZXMEwo
+ngVAR14YqcPxfimulptyXTAFbUXt1eW5Fs6UktqHh+7vP5UMH4MMsMc53GcOpeVl
+p1m2c5U9/Ew34ryQ8XTUL/n1ssYwsN1bRvBmFVpUTYwTxa6dTBNVHE+OQNe+6kLy
+9bM2DI1HEkhz+yFuZiNIehTuoHbceN/5fqzwNGT2orD/QQyK6Sw2jAyxQmveV/Zi
+DWvN4WVgHR52Vu/6fcsBkOmjLO3Lm7tDm4hOdhIOu3lpU8/2wppZuTLZbu4HmbzL
+lpSdtBPfeBP6rRuRV/+KRdbe9jVZcdYkv79GqaeB0x2Y0cK58uY9CRtyJbXDyNJL
+QZIzpeYamUInuc7kWxtu+hTeMICP4DVaNUi6w2wKuKZ+il+1d9syuvBs9yEOrUeX
+O00/cfc6djTyeobCA0+7jJ3EYXNmRNy1UHtKxfK/LDFBJE0Iy7nNePiKli4D
+-----END CERTIFICATE-----