Merge pull request #6 from datachainlab/tcb-eval-num

Add `min_tcb_evaluation_data_number` to Output

Signed-off-by: Jun Kimura <jun.kimura@datachain.jp>

Author: bluele

.github/workflows/test.yml

@@ -30,6 +30,6 @@ jobs:
           curl -L https://risczero.com/install | bash
           echo "$HOME/.risc0/bin" >> $GITHUB_PATH
       - name: Install RISC Zero toolchain
-        run: rzup install rust && rzup install cargo-risczero v1.2.2
+        run: rzup install rust && rzup install cargo-risczero 1.2.2
       - run: . "/home/runner/.bashrc" && ZKDCAP_RISC0_BUILD=1 cargo build -r --manifest-path=./zkvm/risc0/Cargo.toml
       - run: git diff --exit-code

crates/collaterals/src/enclave_identity.rs

@@ -85,7 +85,7 @@ impl EnclaveIdentityV2Builder {
         }
     }
 
-    pub fn tcb_evaluation_data_number(self, tcb_evaluation_data_number: u64) -> Self {
+    pub fn tcb_evaluation_data_number(self, tcb_evaluation_data_number: u32) -> Self {
         Self {
             obj: EnclaveIdentityV2Inner {
                 tcb_evaluation_data_number,

crates/quote-verifier/src/lib.rs

@@ -24,9 +24,9 @@ mod quote_verifier_tests {
     use crate::cert::verify_crl_signature;
     use crate::collaterals::IntelCollateral;
     use crate::crypto::keccak256sum;
-    use crate::quotes::{version_3::verify_quote_dcapv3, version_4::verify_quote_dcapv4};
+    use crate::quotes::{version_3::verify_quote_v3, version_4::verify_quote_v4};
     use crate::tcbinfo::validate_tcbinfov3;
-    use crate::verifier::VerifiedOutput;
+    use crate::verifier::QuoteVerificationOutput;
     use dcap_types::quotes::{version_3::QuoteV3, version_4::QuoteV4};
     use dcap_types::tcbinfo::TcbInfoV3;
     use dcap_types::utils::{parse_crl_der, parse_pem, parse_x509_der, pem_to_der};
@@ -96,7 +96,7 @@ mod quote_verifier_tests {
         let res = QuoteV3::from_bytes(&dcap_quote_bytes);
         assert!(res.is_ok(), "failed to parse quotev3: {:?}", res.err());
         let dcap_quote = res.unwrap();
-        let res = verify_quote_dcapv3(&dcap_quote, &collaterals, 1737458686);
+        let res = verify_quote_v3(&dcap_quote, &collaterals, 1737458686);
         assert!(res.is_ok(), "verification failed: {:?}", res.err());
         let verified_output = res.unwrap();
         assert_eq!(verified_output.quote_version, 3);
@@ -124,7 +124,7 @@ mod quote_verifier_tests {
             "invalid `not_after_min`"
         );
         let bz = verified_output.to_bytes();
-        let res = VerifiedOutput::from_bytes(&bz);
+        let res = QuoteVerificationOutput::from_bytes(&bz);
         assert!(
             res.is_ok(),
             "failed to parse verified output: {:?}",
@@ -154,12 +154,12 @@ mod quote_verifier_tests {
         assert!(res.is_ok(), "failed to parse quotev4: {:?}", res.err());
         let dcap_quote = res.unwrap();
 
-        let res = verify_quote_dcapv4(&dcap_quote, &collaterals, 1737467060);
+        let res = verify_quote_v4(&dcap_quote, &collaterals, 1737467060);
         assert!(res.is_ok(), "verification failed: {:?}", res.err());
         let verified_output = res.unwrap();
         assert_eq!(verified_output.tcb_status, Status::TcbOutOfDate);
         let bz = verified_output.to_bytes();
-        let res = VerifiedOutput::from_bytes(&bz);
+        let res = QuoteVerificationOutput::from_bytes(&bz);
         assert!(
             res.is_ok(),
             "failed to parse verified output: {:?}",

crates/quote-verifier/src/quotes/mod.rs

@@ -27,7 +27,15 @@ use dcap_types::{EnclaveIdentityV2TcbStatus, Status, TcbInfoV3TcbStatus};
 use dcap_types::{ECDSA_256_WITH_P256_CURVE, INTEL_QE_VENDOR_ID};
 use x509_parser::certificate::X509Certificate;
 
-/// common_verify_and_fetch_tcb is a common function that verifies the quote and fetches the TCB info
+/// The TCB info of the QE
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct QeTcb {
+    pub tcb_evaluation_data_number: u32,
+    pub tcb_status: EnclaveIdentityV2TcbStatus,
+    pub advisory_ids: Vec<String>,
+}
+
+/// Verify the quote and return the TCB info of the QE, SGX extensions from the PCK leaf certificate, TCB info of the platform, and the validity intersection of all collaterals
 ///
 /// # Arguments
 ///
@@ -45,13 +53,12 @@ use x509_parser::certificate::X509Certificate;
 /// # Returns
 ///
 /// * A tuple containing:
-/// * The TCB status of the QE
-/// * The advisory IDs of the QE
+/// * The TCB info of the QE
 /// * The SGX extensions from the PCK leaf certificate
-/// * The TCB info
+/// * The TCB info of the platform
 /// * The validity intersection of all collaterals
 #[allow(clippy::too_many_arguments)]
-fn common_verify_and_fetch_tcb(
+fn verify_quote_common(
     quote_header: &QuoteHeader,
     quote_body: &QuoteBody,
     ecdsa_attestation_signature: &[u8; 64],
@@ -62,13 +69,7 @@ fn common_verify_and_fetch_tcb(
     qe_cert_data: &CertData,
     collaterals: &IntelCollateral,
     current_time: u64,
-) -> Result<(
-    EnclaveIdentityV2TcbStatus,
-    Vec<String>,
-    SgxExtensions,
-    TcbInfo,
-    ValidityIntersection,
-)> {
+) -> Result<(QeTcb, SgxExtensions, TcbInfo, ValidityIntersection)> {
     // get the certchain embedded in the ecda quote signature data
     // this can be one of 5 types, and we only support type 5
     // https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/aa239d25a437a28f3f4de92c38f5b6809faac842/QuoteGeneration/quote_wrapper/common/inc/sgx_quote_3.h#L63C4-L63C112
@@ -143,41 +144,34 @@ fn common_verify_and_fetch_tcb(
     };
 
     // validate QE Report and Quote Body
-    let (qe_tcb_status, advisory_ids, pck_cert_sgx_extensions) = {
-        let (qe_tcb_status, advisory_ids) = verify_qe_report(
-            qe_report,
-            ecdsa_attestation_pubkey,
-            qe_auth_data,
-            &qeidentityv2,
-            &pck_leaf_cert,
-            qe_report_signature,
-        )?;
-        verify_quote_attestation(
-            quote_header,
-            quote_body,
-            ecdsa_attestation_pubkey,
-            ecdsa_attestation_signature,
-        )
-        .context("Invalid quote attestation")?;
-
-        (
-            qe_tcb_status,
-            advisory_ids,
-            extract_sgx_extensions(&pck_leaf_cert)?,
-        )
-    };
+    let qe_tcb = verify_qe_report(
+        qe_report,
+        ecdsa_attestation_pubkey,
+        qe_auth_data,
+        &qeidentityv2,
+        &pck_leaf_cert,
+        qe_report_signature,
+    )?;
+    verify_quote_attestation(
+        quote_header,
+        quote_body,
+        ecdsa_attestation_pubkey,
+        ecdsa_attestation_signature,
+    )
+    .context("Invalid quote attestation")?;
+    let pck_cert_sgx_extensions = extract_sgx_extensions(&pck_leaf_cert)?;
 
     if !validity.validate() {
         bail!("Validity intersection provided from collaterals is invalid");
+    } else if !validity.validate_time(current_time) {
+        bail!(
+            "certificates are expired: validity={} current_time={}",
+            validity,
+            current_time
+        );
     }
 
-    Ok((
-        qe_tcb_status,
-        advisory_ids,
-        pck_cert_sgx_extensions,
-        tcb_info,
-        validity,
-    ))
+    Ok((qe_tcb, pck_cert_sgx_extensions, tcb_info, validity))
 }
 
 fn check_quote_header(quote_header: &QuoteHeader, expected_quote_version: u16) -> Result<()> {
@@ -206,7 +200,7 @@ fn verify_qe_report(
     qeidentityv2: &EnclaveIdentityV2,
     pck_leaf_cert: &X509Certificate,
     qe_report_signature: &[u8; 64],
-) -> Result<(EnclaveIdentityV2TcbStatus, Vec<String>)> {
+) -> Result<QeTcb> {
     // validate QEReport then get TCB Status
     if !validate_qe_report_data(
         &qe_report.report_data,
@@ -228,7 +222,14 @@ fn verify_qe_report(
 
     // https://github.com/intel/SGX-TDX-DCAP-QuoteVerificationLibrary/blob/29bd3b0a3b46c1159907d656b45f378f97e7e686/Src/AttestationLibrary/src/Verifiers/EnclaveReportVerifier.cpp#L92
     // https://github.com/intel/SGX-TDX-DCAP-QuoteVerificationLibrary/blob/7e5b2a13ca5472de8d97dd7d7024c2ea5af9a6ba/Src/AttestationLibrary/src/Verifiers/QuoteVerifier.cpp#L286
-    get_qe_tcbstatus(qe_report.isv_svn, &qeidentityv2.enclave_identity.tcb_levels)
+    let (tcb_status, advisory_ids) =
+        get_qe_tcbstatus(qe_report.isv_svn, &qeidentityv2.enclave_identity.tcb_levels)?;
+
+    Ok(QeTcb {
+        tcb_evaluation_data_number: qeidentityv2.enclave_identity.tcb_evaluation_data_number,
+        tcb_status,
+        advisory_ids,
+    })
 }
 
 /// Verify the attestation signature for the quote (header + body) using the attestation public key
@@ -239,8 +240,7 @@ fn verify_quote_attestation(
     ecdsa_attestation_signature: &[u8; 64],
 ) -> Result<()> {
     // verify the signature for attestation body
-    let mut data = Vec::new();
-    data.extend_from_slice(&quote_header.to_bytes());
+    let mut data = quote_header.to_bytes().to_vec();
     match quote_body {
         QuoteBody::SGXQuoteBody(body) => data.extend_from_slice(&body.to_bytes()),
         QuoteBody::TD10QuoteBody(body) => data.extend_from_slice(&body.to_bytes()),

crates/quote-verifier/src/quotes/version_3.rs

@@ -1,61 +1,62 @@
-use super::{
-    check_quote_header, common_verify_and_fetch_tcb, converge_tcb_status_with_qe_tcb, Result,
-};
+use super::{check_quote_header, converge_tcb_status_with_qe_tcb, verify_quote_common, Result};
 use crate::{
     cert::{get_sgx_tdx_fmspc_tcbstatus_v3, merge_advisory_ids},
     collaterals::IntelCollateral,
     crypto::keccak256sum,
-    verifier::VerifiedOutput,
+    verifier::QuoteVerificationOutput,
     VERIFIER_VERSION,
 };
-use anyhow::{bail, Context};
+use anyhow::Context;
+use core::cmp::min;
 use dcap_types::{
     quotes::{body::QuoteBody, version_3::QuoteV3},
     tcbinfo::TcbInfo,
 };
 
-pub fn verify_quote_dcapv3(
+/// Verify the given DCAP quote v3 and return the verification output.
+///
+/// # Arguments
+/// - `quote`: The quote to be verified
+/// - `collateral`: The collateral data to be used for verification
+/// - `current_time`: The current time in seconds since the Unix epoch
+pub fn verify_quote_v3(
     quote: &QuoteV3,
-    collaterals: &IntelCollateral,
+    collateral: &IntelCollateral,
     current_time: u64,
-) -> Result<VerifiedOutput> {
+) -> Result<QuoteVerificationOutput> {
     check_quote_header(&quote.header, 3).context("invalid quote header")?;
 
     let quote_body = QuoteBody::SGXQuoteBody(quote.isv_enclave_report);
-    let (qe_tcb_status, qe_advisory_ids, sgx_extensions, tcb_info, validity) =
-        common_verify_and_fetch_tcb(
-            &quote.header,
-            &quote_body,
-            &quote.signature.isv_enclave_report_signature,
-            &quote.signature.ecdsa_attestation_key,
-            &quote.signature.qe_report,
-            &quote.signature.qe_report_signature,
-            &quote.signature.qe_auth_data.data,
-            &quote.signature.qe_cert_data,
-            collaterals,
-            current_time,
-        )?;
-    if !validity.validate_time(current_time) {
-        bail!(
-            "certificates are expired: validity={} current_time={}",
-            validity,
-            current_time
-        );
-    }
+    let (qe_status, sgx_extensions, tcb_info, validity) = verify_quote_common(
+        &quote.header,
+        &quote_body,
+        &quote.signature.isv_enclave_report_signature,
+        &quote.signature.ecdsa_attestation_key,
+        &quote.signature.qe_report,
+        &quote.signature.qe_report_signature,
+        &quote.signature.qe_auth_data.data,
+        &quote.signature.qe_cert_data,
+        collateral,
+        current_time,
+    )?;
     let TcbInfo::V3(tcb_info_v3) = tcb_info;
     let (tcb_status, _, tcb_advisory_ids) =
         get_sgx_tdx_fmspc_tcbstatus_v3(quote.header.tee_type, None, &sgx_extensions, &tcb_info_v3)?;
 
-    Ok(VerifiedOutput {
+    Ok(QuoteVerificationOutput {
         version: VERIFIER_VERSION,
         quote_version: quote.header.version,
         tee_type: quote.header.tee_type,
-        tcb_status: converge_tcb_status_with_qe_tcb(tcb_status, qe_tcb_status),
+        tcb_status: converge_tcb_status_with_qe_tcb(tcb_status, qe_status.tcb_status),
+        min_tcb_evaluation_data_number: min(
+            qe_status.tcb_evaluation_data_number,
+            tcb_info_v3.tcb_info.tcb_evaluation_data_number,
+        ),
         fmspc: sgx_extensions.fmspc,
-        sgx_intel_root_ca_hash: keccak256sum(collaterals.sgx_intel_root_ca_der.as_ref()),
+        sgx_intel_root_ca_hash: keccak256sum(collateral.sgx_intel_root_ca_der.as_ref()),
         validity,
         quote_body,
-        advisory_ids: merge_advisory_ids(tcb_advisory_ids, qe_advisory_ids),
+        advisory_ids: merge_advisory_ids(tcb_advisory_ids, qe_status.advisory_ids),
     })
 }
 
@@ -143,11 +144,13 @@ mod tests {
         // fmspc and tcb_levels must be consistent with the sgx extensions in the pck cert
         let tcb_info = TcbInfoV3Builder::new(true)
             .fmspc([0, 96, 106, 0, 0, 0])
+            .tcb_evaluation_data_number(2)
             .tcb_levels(target_tcb_levels)
             .build_and_sign(&tcb_certchain.key)
             .unwrap();
 
         let qe_identity = EnclaveIdentityV2Builder::new(EnclaveIdentityId::QE)
+            .tcb_evaluation_data_number(1)
             .tcb_levels_json(json!([
             {
               "tcb": {
@@ -170,7 +173,9 @@ mod tests {
         };
 
         let current_time = 1730000000;
-        let res = verify_quote_dcapv3(&quote, &collateral, current_time);
+        let res = verify_quote_v3(&quote, &collateral, current_time);
         assert!(res.is_ok(), "{:?}", res);
+        let output = res.unwrap();
+        assert_eq!(output.min_tcb_evaluation_data_number, 1);
     }
 }