Bump dice-util

This brings in the asyncification of `trait Attest`, and preparation for
more kinds of nonce.

Author: iximeow

Cargo.lock

@@ -19,12 +19,12 @@ panic = "abort"
 [workspace.dependencies]
 anyhow = { version = "1", default-features = false }
 camino = { version = "1.1.7", default-features = false, features = ["serde1"] }
-attest-data = { git = "https://github.com/oxidecomputer/dice-util", rev = "6e0ef48f72ff85ba50fc8286c8e89dc5f9c822dd" }
+attest-data = { git = "https://github.com/oxidecomputer/dice-util", rev = "d7472bfa91aee859c3fe0bdc1dbb1e320285228e" }
 clap = { version = "4", default-features = false, features = ["std", "derive", "default", "wrap_help"] }
 ciborium = "0.2.2"
 cfg-if = "1.0"
-dice-mfg-msgs = { git = "https://github.com/oxidecomputer/dice-util", rev = "6e0ef48f72ff85ba50fc8286c8e89dc5f9c822dd" }
-dice-verifier = { git = "https://github.com/oxidecomputer/dice-util", rev = "6e0ef48f72ff85ba50fc8286c8e89dc5f9c822dd" }
+dice-mfg-msgs = { git = "https://github.com/oxidecomputer/dice-util", rev = "d7472bfa91aee859c3fe0bdc1dbb1e320285228e" }
+dice-verifier = { git = "https://github.com/oxidecomputer/dice-util", rev = "d7472bfa91aee859c3fe0bdc1dbb1e320285228e" }
 ed25519-dalek = { version = "2.1", default-features = false, features = ["digest", "pkcs8"] }
 libipcc = { git = "https://github.com/oxidecomputer/ipcc-rs", rev = "524eb8f125003dff50b9703900c6b323f00f9e1b" }
 pem-rfc7468 = { version = "0.7.0"}

Cargo.toml

@@ -22,7 +22,8 @@ use crate::{
 use crate::{Error, Stream};
 use camino::Utf8PathBuf;
 use dice_verifier::{
-    Attestation, Corim, Log, MeasurementSet, Nonce, ReferenceMeasurements,
+    Attestation, Corim, Log, MeasurementSet, Nonce, Nonce32,
+    ReferenceMeasurements,
 };
 use hubpack::SerializedSize;
 use rustls::{
@@ -315,7 +316,7 @@ impl Client {
         info!(log, "Running with protocol version {version}");
 
         // send Nonce to server
-        let nonce = Nonce::from_platform_rng()?;
+        let nonce = Nonce::from_platform_rng(Nonce32::LENGTH)?;
         send_msg(&mut stream, nonce.as_ref()).await?;
 
         // get Nonce from server
@@ -326,7 +327,8 @@ impl Client {
         // The attesation protocol has an inherent race condition between
         // getting the log and the attestation. We verify our own attestation
         // before sending it to the challenger to fail as early as possible.
-        let attest_data = get_attest_data(&attest_config, &server_nonce)?;
+        let attest_data =
+            get_attest_data(&attest_config, &server_nonce).await?;
         dice_verifier::verify_attestation(
             &attest_data.certs[0],
             &attest_data.attestation,

tls/src/client.rs

@@ -406,21 +406,20 @@ pub struct AttestArtifacts {
     pub test_corpus: Vec<Utf8PathBuf>,
 }
 
-/// This function encapsulates our IPCC usage in a non-async function. This is
-/// required till the Ipcc handle is `Send`.
+/// Collect attestation information from the configured attestor.
 ///
 /// NOTE: The `Nonce` parameter must be the nonce provided by the peer in an
 /// attestation exchange.
-pub fn get_attest_data(
+pub async fn get_attest_data(
     config: &AttestConfig,
     nonce: &dice_verifier::Nonce,
 ) -> Result<AttestArtifacts, Error> {
     use dice_verifier::{ipcc::AttestIpcc, Attest, AttestMock};
 
     // create the `Attest` impl prescribed by the config
-    let (attest, test_corpus): (Box<dyn Attest>, Vec<Utf8PathBuf>) =
+    let (attest, test_corpus): (Box<dyn Attest + Send>, Vec<Utf8PathBuf>) =
         match config {
-            AttestConfig::Ipcc => (Box::new(AttestIpcc::new()?), vec![]),
+            AttestConfig::Ipcc => (Box::new(AttestIpcc {}), vec![]),
             AttestConfig::Local {
                 priv_key,
                 cert_chain,
@@ -432,10 +431,14 @@ pub fn get_attest_data(
             ),
         };
 
+    let certs = attest.get_certificates().await?;
+    let log = attest.get_measurement_log().await?;
+    let attestation = attest.attest(nonce).await?;
+
     Ok(AttestArtifacts {
-        certs: attest.get_certificates()?,
-        log: attest.get_measurement_log()?,
-        attestation: attest.attest(nonce)?,
+        certs,
+        log,
+        attestation,
         test_corpus,
     })
 }

tls/src/keys.rs

@@ -86,6 +86,9 @@ pub enum Error {
     #[error("AttestData error")]
     AttestData(#[from] attest_data::AttestDataError),
 
+    #[error("Nonce error")]
+    NonceError(#[from] attest_data::NonceError),
+
     #[error("Failed to verify peer attestation cert chain")]
     AttestCertVerifier(#[from] dice_verifier::PkiPathSignatureVerifierError),