Skip to content

Commit 2780fca

Browse files
yogeshbdeshpandeyogeshbdeshpande
authored
Align CCA naming in README to CCA specs (#27)
Fix #15 Signed-off-by: Yogesh Deshpande <[email protected]>
1 parent 7cc8730 commit 2780fca

File tree

8 files changed

+76
-76
lines changed

8 files changed

+76
-76
lines changed

‎README-CCA.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
## CCA attestation tokens manipulation
22

33
The `cca` subcommand allows you to [create](#create), [check](#check) and
4-
[verify](#verify) CCA attestation tokens.
4+
[verify](#verify) [CCA attestation tokens](https://github.com/veraison/ccatoken).
55

66
### Create
77

88
Use the `cca create` subcommand to create a CCA attestation token from the
9-
supplied claims in JSON format, the Platform Attestation Key (PAK) and Realm
9+
supplied claims in JSON format, the Initial Attestation Key (IAK) and Realm
1010
Attestation Key (RAK) in JSON Web Key (JWK) format<sup>[1](#inputs-ex)</sup>.
1111

1212
```shell
1313
evcli cca create \
1414
--claims=cca-claims.json \
15-
--pak=ec256.json \
15+
--iak=ec256.json \
1616
--rak=ec384.json
1717
```
1818

@@ -31,7 +31,7 @@ For example:
3131
```shell
3232
evcli cca create \
3333
--claims=cca-claims.json \
34-
--pak=ec256.json \
34+
--iak=ec256.json \
3535
--rak=ec384.json
3636
--token=my.cbor
3737
```
@@ -41,7 +41,7 @@ evcli cca create \
4141
Use the `cca check` subcommand to verify the cryptographic signature on the
4242
supplied CCA attestation token as well as checking whether all claim sets
4343
within CCA token are well-formed. Please note that only one key (the public
44-
part of platform IAK) needs to be supplied, as the public part of RAK, present
44+
part of IAK) needs to be supplied, as the public part of RAK, present
4545
in the token is used for signature verification.
4646

4747
To check the CCA attestation token in my.cbor using the public key in
@@ -128,7 +128,7 @@ claims, platform signing (IAK) and realm signing key (RAK).
128128
evcli cca verify-as attester \
129129
--api-server=https://veraison.example/challenge-response/v1/newSession \
130130
--claims=cca-claims-without-realm-challenge.json \
131-
--pak=es256.json \
131+
--iak=es256.json \
132132
--rak=ec384.json
133133
```
134134

‎cmd/cca/check.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ func NewCheckCmd(fs afero.Fs) *cobra.Command {
2727
Long: `Run the syntactic and cryptographic signature checks over the
2828
supplied CCA attestation token.
2929
30-
Check a CCA attestation token contained in my.cbor using the public PAK in
30+
Check a CCA attestation token contained in my.cbor using the public IAK in
3131
es256.jwk and save the embedded claims to claims.json:
3232
3333
evcli cca check --token=my.cbor --key=es256.jwk --claims=claims.json
@@ -36,7 +36,7 @@ Or, equivalently:
3636
3737
evcli cca check -t my.cbor -k es256.jwt -c claims.json
3838
39-
check a CCA attestation token contained in te.cbor using the public PAK in
39+
check a CCA attestation token contained in te.cbor using the public IAK in
4040
es256.jwk and dump the embedded claims to standard output:
4141
4242
evcli cca check -t te.cbor -k es256.jwk

‎cmd/cca/check_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ func Test_CheckCmd_claims_to_stdout_ok(t *testing.T) {
1717
err := afero.WriteFile(fs, "ccatoken.CBOR", testValidCCAToken, 0644)
1818
require.NoError(t, err)
1919

20-
err = afero.WriteFile(fs, "es256.jwk", testValidPAKPub, 0644)
20+
err = afero.WriteFile(fs, "es256.jwk", testValidIAKPub, 0644)
2121
require.NoError(t, err)
2222

2323
cmd := NewCheckCmd(fs)
@@ -38,7 +38,7 @@ func Test_CheckCmd_claims_to_file_ok(t *testing.T) {
3838
err := afero.WriteFile(fs, "ccatoken.CBOR", testValidCCAToken, 0644)
3939
require.NoError(t, err)
4040

41-
err = afero.WriteFile(fs, "es256.jwk", testValidPAKPub, 0644)
41+
err = afero.WriteFile(fs, "es256.jwk", testValidIAKPub, 0644)
4242
require.NoError(t, err)
4343

4444
cmd := NewCheckCmd(fs)
@@ -63,7 +63,7 @@ func Test_CheckCmd_claims_to_file_fail(t *testing.T) {
6363
err := afero.WriteFile(fs, "ccatoken.CBOR", testValidCCAToken, 0644)
6464
require.NoError(t, err)
6565

66-
err = afero.WriteFile(fs, "es256.jwk", testValidPAKPub, 0644)
66+
err = afero.WriteFile(fs, "es256.jwk", testValidIAKPub, 0644)
6767
require.NoError(t, err)
6868

6969
// freeze the FS so that writing is not possible any more
@@ -153,7 +153,7 @@ func Test_CheckCmd_key_not_found(t *testing.T) {
153153
func Test_CheckCmd_token_not_found(t *testing.T) {
154154
fs := afero.NewMemMapFs()
155155

156-
err := afero.WriteFile(fs, "es256.jwk", testValidPAKPub, 0644)
156+
err := afero.WriteFile(fs, "es256.jwk", testValidIAKPub, 0644)
157157
require.NoError(t, err)
158158

159159
cmd := NewCheckCmd(fs)
@@ -176,7 +176,7 @@ func Test_CheckCmd_token_invalid_format(t *testing.T) {
176176
err := afero.WriteFile(fs, "ccatoken.cbor", testInvalidCCAToken, 0644)
177177
require.NoError(t, err)
178178

179-
err = afero.WriteFile(fs, "es256.jwk", testValidPAKPub, 0644)
179+
err = afero.WriteFile(fs, "es256.jwk", testValidIAKPub, 0644)
180180
require.NoError(t, err)
181181

182182
cmd := NewCheckCmd(fs)
@@ -199,7 +199,7 @@ func Test_CheckCmd_regression_bug_18(t *testing.T) {
199199
err := afero.WriteFile(fs, "ccatoken.cbor", testValidCCAToken, 0644)
200200
require.NoError(t, err)
201201

202-
err = afero.WriteFile(fs, "not-a-public-key.jwk", testValidPAK, 0644)
202+
err = afero.WriteFile(fs, "not-a-public-key.jwk", testValidIAK, 0644)
203203
require.NoError(t, err)
204204

205205
cmd := NewCheckCmd(fs)

‎cmd/cca/create.go‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import (
1414
var (
1515
createClaimsFile *string
1616
createRAKFile *string
17-
createPAKFile *string
17+
createIAKFile *string
1818
createTokenFile *string
1919
allowInvalidClaims *bool
2020
)
@@ -26,12 +26,12 @@ func NewCreateCmd(fs afero.Fs) *cobra.Command {
2626
Use: "create",
2727
Short: "create a CCA attestation token from the supplied claims and keys",
2828
Long: `Create a CCA attestation token from the JSON-encoded claims and
29-
keys (PAK and RAK)
29+
keys (IAK and RAK)
3030
3131
Create a CCA attestation token from claims contained in claims.json, sign
32-
with pak.jwk and rak.jwk and save the result to my.cbor:
32+
with iak.jwk and rak.jwk and save the result to my.cbor:
3333
34-
evcli cca create --claims=claims.json --pak=pak.jwk --rak=rak.jwk --token=my.cbor
34+
evcli cca create --claims=claims.json --iak=iak.jwk --rak=rak.jwk --token=my.cbor
3535
`,
3636
RunE: func(cmd *cobra.Command, args []string) error {
3737
validate := !*allowInvalidClaims
@@ -60,19 +60,19 @@ with pak.jwk and rak.jwk and save the result to my.cbor:
6060
)
6161
}
6262

63-
pak, err := afero.ReadFile(fs, *createPAKFile)
63+
iak, err := afero.ReadFile(fs, *createIAKFile)
6464
if err != nil {
6565
return fmt.Errorf(
66-
"error loading PAK signing key from %s: %w",
67-
*createPAKFile, err,
66+
"error loading IAK signing key from %s: %w",
67+
*createIAKFile, err,
6868
)
6969
}
7070

71-
pSigner, err := common.SignerFromJWK(pak)
71+
pSigner, err := common.SignerFromJWK(iak)
7272
if err != nil {
7373
return fmt.Errorf(
74-
"error decoding PAK signing key from %s: %w",
75-
*createPAKFile, err,
74+
"error decoding IAK signing key from %s: %w",
75+
*createIAKFile, err,
7676
)
7777
}
7878

@@ -112,8 +112,8 @@ with pak.jwk and rak.jwk and save the result to my.cbor:
112112
"rak", "r", "", "JWK file with the key used for signing the realm token",
113113
)
114114

115-
createPAKFile = cmd.Flags().StringP(
116-
"pak", "p", "", "JWK file with the key used for signing the platform token",
115+
createIAKFile = cmd.Flags().StringP(
116+
"iak", "p", "", "JWK file with the key used for signing the platform token",
117117
)
118118

119119
createTokenFile = cmd.Flags().StringP(
@@ -130,7 +130,7 @@ with pak.jwk and rak.jwk and save the result to my.cbor:
130130
}
131131

132132
func init() {
133-
for _, param := range []string{"claims", "rak", "pak"} {
133+
for _, param := range []string{"claims", "rak", "iak"} {
134134
if err := createCmd.MarkFlagRequired(param); err != nil {
135135
panic(err)
136136
}

‎cmd/cca/create_test.go‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import (
1414
func Test_CreateCmd_default_token_name_ok(t *testing.T) {
1515
fs := afero.NewMemMapFs()
1616

17-
err := afero.WriteFile(fs, "es256.jwk", testValidPAK, 0644)
17+
err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644)
1818
require.NoError(t, err)
1919

2020
err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644)
@@ -27,7 +27,7 @@ func Test_CreateCmd_default_token_name_ok(t *testing.T) {
2727
cmd.SetArgs(
2828
[]string{
2929
"--claims=claims.json",
30-
"--pak=es256.jwk",
30+
"--iak=es256.jwk",
3131
"--rak=es384.jwk",
3232
},
3333
)
@@ -42,7 +42,7 @@ func Test_CreateCmd_default_token_name_ok(t *testing.T) {
4242
func Test_CreateCmd_custom_token_name_ok(t *testing.T) {
4343
fs := afero.NewMemMapFs()
4444

45-
err := afero.WriteFile(fs, "es256.jwk", testValidPAK, 0644)
45+
err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644)
4646
require.NoError(t, err)
4747

4848
err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644)
@@ -55,7 +55,7 @@ func Test_CreateCmd_custom_token_name_ok(t *testing.T) {
5555
cmd.SetArgs(
5656
[]string{
5757
"--claims=claims.json",
58-
"--pak=es256.jwk",
58+
"--iak=es256.jwk",
5959
"--rak=es384.jwk",
6060
"--token=my.cbor",
6161
},
@@ -71,7 +71,7 @@ func Test_CreateCmd_custom_token_name_ok(t *testing.T) {
7171
func Test_CreateCmd_save_token_fail(t *testing.T) {
7272
fs := afero.NewMemMapFs()
7373

74-
err := afero.WriteFile(fs, "es256.jwk", testValidPAK, 0644)
74+
err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644)
7575
require.NoError(t, err)
7676

7777
err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644)
@@ -87,7 +87,7 @@ func Test_CreateCmd_save_token_fail(t *testing.T) {
8787
cmd.SetArgs(
8888
[]string{
8989
"--claims=claims.json",
90-
"--pak=es256.jwk",
90+
"--iak=es256.jwk",
9191
"--rak=es384.jwk",
9292
},
9393
)
@@ -101,7 +101,7 @@ func Test_CreateCmd_save_token_fail(t *testing.T) {
101101
func Test_CreateCmd_RAK_invalid(t *testing.T) {
102102
fs := afero.NewMemMapFs()
103103

104-
err := afero.WriteFile(fs, "es256.jwk", testValidPAK, 0644)
104+
err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644)
105105
require.NoError(t, err)
106106

107107
err = afero.WriteFile(fs, "es384.jwk", testInvalidKey, 0644)
@@ -114,7 +114,7 @@ func Test_CreateCmd_RAK_invalid(t *testing.T) {
114114
cmd.SetArgs(
115115
[]string{
116116
"--claims=claims.json",
117-
"--pak=es256.jwk",
117+
"--iak=es256.jwk",
118118
"--rak=es384.jwk",
119119
},
120120
)
@@ -128,7 +128,7 @@ func Test_CreateCmd_RAK_invalid(t *testing.T) {
128128
func Test_CreateCmd_RAK_not_found(t *testing.T) {
129129
fs := afero.NewMemMapFs()
130130

131-
err := afero.WriteFile(fs, "es256.jwk", testValidPAK, 0644)
131+
err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644)
132132
require.NoError(t, err)
133133

134134
err = afero.WriteFile(fs, "claims.json", testValidCCAClaims, 0644)
@@ -138,7 +138,7 @@ func Test_CreateCmd_RAK_not_found(t *testing.T) {
138138
cmd.SetArgs(
139139
[]string{
140140
"--claims=claims.json",
141-
"--pak=es256.jwk",
141+
"--iak=es256.jwk",
142142
"--rak=es384.jwk",
143143
},
144144
)
@@ -149,7 +149,7 @@ func Test_CreateCmd_RAK_not_found(t *testing.T) {
149149
assert.EqualError(t, err, expectedErr)
150150
}
151151

152-
func Test_CreateCmd_PAK_invalid(t *testing.T) {
152+
func Test_CreateCmd_IAK_invalid(t *testing.T) {
153153
fs := afero.NewMemMapFs()
154154

155155
err := afero.WriteFile(fs, "es256.jwk", testInvalidKey, 0644)
@@ -165,18 +165,18 @@ func Test_CreateCmd_PAK_invalid(t *testing.T) {
165165
cmd.SetArgs(
166166
[]string{
167167
"--claims=claims.json",
168-
"--pak=es256.jwk",
168+
"--iak=es256.jwk",
169169
"--rak=es384.jwk",
170170
},
171171
)
172172

173-
expectedErr := `error decoding PAK signing key from es256.jwk: failed to parse key: invalid key type from JSON ()`
173+
expectedErr := `error decoding IAK signing key from es256.jwk: failed to parse key: invalid key type from JSON ()`
174174

175175
err = cmd.Execute()
176176
assert.EqualError(t, err, expectedErr)
177177
}
178178

179-
func Test_CreateCmd_PAK_not_found(t *testing.T) {
179+
func Test_CreateCmd_IAK_not_found(t *testing.T) {
180180
fs := afero.NewMemMapFs()
181181

182182
err := afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644)
@@ -189,12 +189,12 @@ func Test_CreateCmd_PAK_not_found(t *testing.T) {
189189
cmd.SetArgs(
190190
[]string{
191191
"--claims=claims.json",
192-
"--pak=es256.jwk",
192+
"--iak=es256.jwk",
193193
"--rak=es384.jwk",
194194
},
195195
)
196196

197-
expectedErr := `error loading PAK signing key from es256.jwk: open es256.jwk: file does not exist`
197+
expectedErr := `error loading IAK signing key from es256.jwk: open es256.jwk: file does not exist`
198198

199199
err = cmd.Execute()
200200
assert.EqualError(t, err, expectedErr)
@@ -203,7 +203,7 @@ func Test_CreateCmd_PAK_not_found(t *testing.T) {
203203
func Test_CreateCmd_claims_not_found(t *testing.T) {
204204
fs := afero.NewMemMapFs()
205205

206-
err := afero.WriteFile(fs, "es256.jwk", testValidPAK, 0644)
206+
err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644)
207207
require.NoError(t, err)
208208

209209
err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644)
@@ -213,7 +213,7 @@ func Test_CreateCmd_claims_not_found(t *testing.T) {
213213
cmd.SetArgs(
214214
[]string{
215215
"--claims=claims.json",
216-
"--pak=es256.jwk",
216+
"--iak=es256.jwk",
217217
"--rak=es384.jwk",
218218
},
219219
)
@@ -227,7 +227,7 @@ func Test_CreateCmd_claims_not_found(t *testing.T) {
227227
func Test_CreateCmd_claims_invalid(t *testing.T) {
228228
fs := afero.NewMemMapFs()
229229

230-
err := afero.WriteFile(fs, "es256.jwk", testValidPAK, 0644)
230+
err := afero.WriteFile(fs, "es256.jwk", testValidIAK, 0644)
231231
require.NoError(t, err)
232232

233233
err = afero.WriteFile(fs, "es384.jwk", testValidRAK, 0644)
@@ -240,7 +240,7 @@ func Test_CreateCmd_claims_invalid(t *testing.T) {
240240
cmd.SetArgs(
241241
[]string{
242242
"--claims=claims.json",
243-
"--pak=es256.jwk",
243+
"--iak=es256.jwk",
244244
"--rak=es384.jwk",
245245
},
246246
)

‎cmd/cca/test_common.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ var (
1212
"y": "7fVF7b6J_6_g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E-M7IF-bsxqcdOj3n1n7N",
1313
"d": "ODkwMTIzNDU2Nzg5MDEyMz7deMbyLt8g4cjcxozuIoygLLlAeoQ1AfM9TSvxkFHJ"
1414
}`)
15-
testValidPAK = []byte(`{
16-
"kid": "valid-pak",
15+
testValidIAK = []byte(`{
16+
"kid": "valid-iak",
1717
"kty": "EC",
1818
"crv": "P-256",
1919
"x": "MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",
@@ -27,8 +27,8 @@ var (
2727
"x": "gvvRMqm1w5aHn7sVNA2QUJeOVcedUnmiug6VhU834gzS9k87crVwu9dz7uLOdoQl",
2828
"y": "7fVF7b6J_6_g6Wu9RuJw8geWxEi5ja9Gp2TSdELm5u2E-M7IF-bsxqcdOj3n1n7N"
2929
}`)
30-
testValidPAKPub = []byte(`{
31-
"kid": "valid-pak-pub",
30+
testValidIAKPub = []byte(`{
31+
"kid": "valid-iak-pub",
3232
"kty": "EC",
3333
"crv": "P-256",
3434
"x": "MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",

0 commit comments

Comments
 (0)