Feature: Standardize attestation policy

[SammyOina]

Is your feature request related to a problem? Please describe.

We have TDX and SNP policies and need a uniform representation. since there is no standard

Describe the feature you are requesting, as well as the possible use case(s) for it.

A standard attestation policy, with uniform serialization

Indicate the importance of this feature to you.

Must-have

Anything else?

No response

[SammyOina]

Standardized Attestation Policy Specification for CoCo's

This document defines a standardized JSON format for CoCo's attestation policies. The purpose of this specification is to provide a single, unified structure for verifying TEE attestation reports, regardless of the underlying hardware (e.g., AMD SEV-SNP, Intel TDX).

1. Top-Level Policy Structure

The root of the policy is a single JSON object.

Field	Type	Description
version	String	A semantic version string for the policy specification. E.g., "1.0.0".
description	String	A human-readable description of the policy's purpose.
policy	Object	The main policy object containing all verification rules.
rootOfTrust	Object	Rules for verifying the attestation report's signing certificate.

2. Policy Object

The policy object contains all rules for verifying the TEE's state.

Field	Type	Description
teeType	String	Required. The type of TEE this policy applies to. Supported values include "AMD-SEV-SNP", "INTEL-TDX".
expectedMeasurements	Object	A collection of expected measurement values (e.g., PCRs or RTMRs).
teeSpecificPolicy	Object	TEE-specific verification rules. The schema for this object depends on the teeType.
vmpl	Integer	Optional (SEV-SNP only). The Virtual Machine Privilege Level to be verified.

2.1. expectedMeasurements Object

This object standardizes the verification of platform configuration registers (PCRs) for AMD SEV-SNP and run-time measurements (RTMRs) for Intel TDX.

Field	Type	Description
hashAlgorithm	String	The cryptographic hash algorithm used. E.g., "SHA256", "SHA384".
measurements	Object	A key-value map of measurement names to their expected hash values. The key format should be consistent, e.g., "pcr_0", "rtmr_0".

Example:

"expectedMeasurements": {  
  "hashAlgorithm": "SHA384",  
  "measurements": {  
    "pcr\_0": "ff93a763afde2c4a152d4843d9fcabe73a70d4f34bf8861845f2ab08440c1f0742b5882ed7f2524e38a3a6e40fbcdfca",  
    "pcr\_1": "c9b3bcc22d856cbc5be2a2bf72d81819df325db083cfea20e84d082a87f44d643e6fca98f29eb3cce4c87eed2dbca2e5"  
  }  
}

2.2. teeSpecificPolicy Object

This is a dynamic object whose structure is determined by the teeType.

teeType: "AMD-SEV-SNP"

Field	Type	Description
minimumLaunchTcb	Integer	The minimum Launch TCB version required.
minimumBuild	Integer	The minimum SEV-SNP build number.
familyId	String	The expected family ID of the platform.
imageId	String	The expected image ID.
chipId	String	The expected unique chip ID of the platform.
hostData	String	The expected host data value.
policy	Integer	The expected SNP policy flags.
permitProvisionalFirmware	Boolean	Whether provisional firmware is permitted.
measurement	String	The expected MEASUREMENT field from the attestation report.

teeType: "INTEL-TDX"

Field	Type	Description
minimumTeeTcbSvn	String	Base64-encoded minimum TeeTcbSvn value.
mrSeam	String	Base64-encoded expected MRSIGNER value.
mrTd	String	Base64-encoded expected MR_TD value.
tdAttributes	String	Base64-encoded expected TD_ATTRIBUTES.
xfam	String	Base64-encoded expected XFAM.
qeVendorId	String	Base64-encoded expected Quote Enclave Vendor ID.

3. Root of Trust Verification

The rootOfTrust object contains rules for validating the signing chain of the attestation report.

Field	Type	Description
checkCrl	Boolean	Whether to perform a CRL (Certificate Revocation List) check on the certificates.
getCollateral	Boolean	Optional (TDX only). Whether to fetch collateral for verification.

4. Examples

Here are two complete examples demonstrating how a full policy would be structured for both AMD SEV-SNP and Intel TDX.

4.1. AMD SEV-SNP Example

{  
  "version": "1.0.0",  
  "description": "Policy for a specific AMD SEV-SNP environment",  
  "policy": {  
    "teeType": "AMD-SEV-SNP",  
    "vmpl": 2,  
    "expectedMeasurements": {  
      "hashAlgorithm": "SHA384",  
      "measurements": {  
        "pcr\_0": "ff93a763afde2c4a152d4843d9fcabe73a70d4f34bf8861845f2ab08440c1f0742b5882ed7f2524e38a3a6e40fbcdfca",  
        "pcr\_1": "c9b3bcc22d856cbc5be2a2bf72d81819df325db083cfea20e84d082a87f44d643e6fca98f29eb3cce4c87eed2dbca2e5",  
        "pcr\_2": "518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4",  
        "pcr\_3": "518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4",  
        "pcr\_4": "d18d213c26e7bc309e52448bde2f0a8ef86be388223f64f85c4e0c625f1e0a7f8c901d4f7c98f8445730bc63c4dfa88d",  
        "pcr\_5": "c50b529497c7f441ea47305587d6ce83e2e31f7b4fab6c13dc0b0c3c900e1d0caf0768321100927862df142bf0465ee4",  
        "pcr\_6": "518923b0f955d08da077c96aaba522b9decede61c599cea6c41889cfbea4ae4d50529d96fe4d1afdafb65e7f95bf23c4",  
        "pcr\_7": "ea40cbd8f51eed103d75821340e71fa3c0cfde3e75c360b4c9aca534b7fed021e12f8890acef36ccfe12b33ea4111576",  
        "pcr\_9": "02556c6b494abaf21481def35b38574e80dc68f20ceb8385f78a5ad4ecfbab60f9fcfca7c69f09a081fdd4ca13f3c14d"  
      }  
    },  
    "teeSpecificPolicy": {  
      "minimumLaunchTcb": 15352208179752599555,  
      "minimumBuild": 8,  
      "familyId": "AAAAAAAAAAAAAAAAAAAAAA==",  
      "imageId": "AAAAAAAAAAAAAAAAAAAAAA==",  
      "chipId": "GrFqtQ+lrkLsjBslu9pcC6XqkrtFWY1ArIQ+I4gugQIsvCG0qekSvEtE4P/SLSJ6mHNpOkY0MHnGpvz1OkV+kw==",  
      "hostData": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",  
      "policy": 196608,  
      "permitProvisionalFirmware": true,  
      "measurement": "oDYo4e98Da2Fy73nDVZmxiWiz+5gnxae7NMRtdfnwpbBuVYZsI0mynz3fpfe+YIX"  
    }  
  },  
  "rootOfTrust": {  
    "checkCrl": true  
  }  
}

4.2. Intel TDX Example

{  
  "version": "1.0.0",  
  "description": "Policy for a specific Intel TDX environment",  
  "policy": {  
    "teeType": "INTEL-TDX",  
    "expectedMeasurements": {  
      "hashAlgorithm": "SHA384",  
      "measurements": {  
        "rtmr\_0": "Q/awR9AZ8zBCgNpi3MBhW7gm/VAkC1pWcThhWHWumNXRC12+FwnLJmFnc9d3V8b5",  
        "rtmr\_1": "gA+mzgX6FIdGOac2CPnPKwI/lFqSecT01m0s4El1Ul/jgok3mlXPOZdxj0fcgIP+",  
        "rtmr\_2": "eIAbT0GVA57+nX44KZ2vkopPVjmroajnJnaQ+ksJCl0EQsradehgoouXG8pD1pk7",  
        "rtmr\_3": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"  
      }  
    },  
    "teeSpecificPolicy": {  
      "minimumTeeTcbSvn": "BgEDAAAAAAAAAAAAAAAAAA==",  
      "mrSeam": "WzjjOmSHlYtyw8Eqk46qXj/UUQxRruq1jH1ezuQdfENkidbI5PkvFgt8rTQgewDB",  
      "mrTd": "kesrRNFB1Ozgnwx1wsU9JHo8aO3X+v6KNSDJQqYEpAfeA65txfh/J0KLJTiHMRi3",  
      "tdAttributes": "AAAAEAAAAAA=",  
      "xfam": "5wIGAAAAAAA=",  
      "qeVendorId": "k5pyM/ecTKmUCg2zlX8GBw=="  
    }  
  },  
  "rootOfTrust": {  
    "checkCrl": true,  
    "getCollateral": true  
  }  
}  

[SammyOina]

https://www.openpolicyagent.org/

[dborovcanin]

Related to #975.