chore(tee): align reportData and node-key docs with the code (#4265)

Author: barakeinav1

crates/attestation/src/attestation.rs

@@ -270,15 +270,15 @@ impl DstackAttestation {
         Ok(report.advisory_ids.clone())
     }
 
-    /// Verifies report data matches expected values.
+    /// Verifies the quote's report data matches `expected`.
+    ///
+    /// Matching the full blob proves the caller's expected report data was bound into the quote
+    /// by an app running inside a TDX enclave. Its layout is the caller's concern.
     fn verify_report_data(
         &self,
         expected: &ReportData,
         actual: &TDReport10,
     ) -> Result<(), VerificationError> {
-        // Check if sha384(tls_public_key) matches the hash in report_data. This check effectively
-        // proves that tls_public_key was included in the quote's report_data by an app running
-        // inside a TDX enclave.
         compare_hashes("report_data", &actual.report_data, &expected.to_bytes())
     }
 

crates/mpc-attestation/src/report_data.rs

@@ -62,7 +62,7 @@ impl core::borrow::Borrow<[u8]> for Ed25519PublicKey {
 }
 
 /// report_data_v1: [u8; 64] =
-/// [version(2 bytes big endian) || sha384(TLS pub key || account_pubkey) || zero padding]
+/// [version(2 bytes big endian) || sha3-384(TLS pub key || account_pubkey) || zero padding]
 impl ReportDataV1 {
     /// V1-specific format constants
     const PUBLIC_KEYS_OFFSET: usize = BINARY_VERSION_OFFSET + BINARY_VERSION_SIZE;
@@ -86,9 +86,7 @@ impl ReportDataV1 {
         );
     };
 
-    /// Computes a SHA3-384 hash over two public keys.
-    ///
-    /// Returns and arraySha384 (tls_public_key || account_public_key)
+    /// Returns SHA3-384(tls_public_key || account_public_key).
     fn compute_public_keys_hash(
         tls_public_key: impl AsRef<[u8]>,
         account_public_key: impl AsRef<[u8]>,

docs/migration-service.md

@@ -382,7 +382,7 @@ Additionally, the backup service will need to provide a TEE attestation similar
 The backup service attestation registreation and verification would follow the same process as MPC node attestations:
 1. Backup service generates TLS keypair inside TEE
 2. Backup service generates account keypair inside TEE for signing contract transactions (required to submit the attestation to the contract)
-3. Creates `ReportData` V1: `[version(2 bytes big endian) || sha384(TLS pub key || account_pubkey) || zero padding]`
+3. Creates `ReportData` V1: `[version(2 bytes big endian) || sha3-384(TLS pub key || account_pubkey) || zero padding]`
 4. Obtains TEE quote embedding the `ReportData`
 5. Submits attestation via `register_backup_service(tls_public_key, account_public_key, attestation)`
 6. Contract verifies (using existing `TeeState` verification logic):

docs/securing-mpc-with-tee-design-doc.md

@@ -424,7 +424,7 @@ We grant access to all contract methods rather than an explicit allow-list becau
 
 In addition - The node will generate multiple responder account keys as well. These are used to increase throughout when posting generated MPC signatures to the chain.
 
-_Note - We plan (in future release) to add a restriction that some of contract API can only be invoked with the node key and not the operators key, those enhancing the security and separation of duty._
+Node-only contract APIs (`respond`, `respond_ckd`, `respond_verify_foreign_tx`, the key-event calls, `register_foreign_chains_config`) reject the operator key: the contract requires the signer key to be the attested node account key.
 
 ## Remote Attestation
 
@@ -440,9 +440,7 @@ The node will use the Dstack APIs in order to generate the remote attestation in
 
 - A TDX quote (including RTMRs and reportData)
 
-  - reportData == Version || SHA384(node's TLS P2P public key)
-
-    _Note_ - In a future release, we plan to add the hash of node's public account key as well - in order to be able to add restriction on the operator calling some of the contract APIs
+  - reportData == Version (2 bytes, big endian) || SHA3-384(node's TLS P2P public key || node's account public key), zero-padded to 64 bytes
 
 - Collateral (TCB Info, QE Identity, PCK CRL) — fetched from a configurable PCCS endpoint chain. See [PCCS Collateral Handling](#pccs-collateral-handling) below for endpoint configuration, freshness, and TLS trust.
 
@@ -473,7 +471,7 @@ Review Dstack [RMTR calculation and attestation](https://github.com/Dstack-TEE/d
 Those are the high level steps the contract does in order to verify the attestation quote generated by the MPC node.
 
 1. Verify TDX quote (according to intel spec, mainly validating signatures and chain of trust).
-2. Verify Reportdata  == Version || SHA384(node's public signing key)
+2. Verify Reportdata  == Version || SHA3-384(node's TLS P2P public key || node's account public key)
 
    byte Version=2 bytes, big endian.