Skip to content

Commit b3c6251

Browse files
Sukuna0007AbhiSukuna0007Abhi
authored
Simplify vendor/model implementation per review feedback
- Remove sanitization files (sanitize.go, sanitize_test.go) - Extract vendor/model directly without validation - Simplify README: keep one example, remove Security section - Add vendor/model support to SwAttr for supply chain Addresses feedback from sir @yogeshbdeshpande Signed-off-by: Sukuna0007Abhi <[email protected]>
1 parent a63f97f commit b3c6251

File tree

5 files changed

+33
-498
lines changed

5 files changed

+33
-498
lines changed

‎scheme/parsec-tpm/README.md‎

Lines changed: 2 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ Both fields support:
4343
- Special characters (allowed in both fields)
4444
- Variable length strings (no artificial length restrictions)
4545

46-
### CORIM Example
46+
### CoRIM Example
4747

48-
To include vendor and model information in your CORIM manifest, add them to the `environment.class` section (following standard CoRIM specification). Here are several examples:
48+
To include vendor and model information in your CoRIM manifest, add them to the `environment.class` section (following standard CoRIM specification):
4949

5050
```json
5151
{
@@ -74,116 +74,3 @@ To include vendor and model information in your CORIM manifest, add them to the
7474
]
7575
}
7676
```
77-
78-
Additional Examples:
79-
80-
1. International Vendor (with Unicode characters):
81-
```json
82-
{
83-
"comid.verification-keys": [
84-
{
85-
"environment": {
86-
"class": {
87-
"id": {
88-
"class-id": "cd1f0e55-26f9-460d-b9d8-f7fde171787c"
89-
},
90-
"vendor": "富士通株式会社",
91-
"model": "FUJITSU TPM 2.0"
92-
},
93-
"instance": {
94-
"instance-id": {
95-
"type": "ueid",
96-
"value": "AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
97-
}
98-
}
99-
},
100-
"key": [{
101-
"type": "pkix-base64-key",
102-
"value": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETKRFE_RwSXooI8DdatPOYg_uiKm2XrtT_uEMEvqQZrwJHHcfw0c3WVzGoqL3Y_Q6xkHFfdUVqS2WWkPdKO03uw=="
103-
}]
104-
}
105-
]
106-
}
107-
```
108-
109-
2. Minimal Example (vendor only):
110-
```json
111-
{
112-
"comid.verification-keys": [
113-
{
114-
"environment": {
115-
"class": {
116-
"id": {
117-
"class-id": "cd1f0e55-26f9-460d-b9d8-f7fde171787c"
118-
},
119-
"vendor": "Intel Corporation"
120-
},
121-
"instance": {
122-
"instance-id": {
123-
"type": "ueid",
124-
"value": "AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
125-
}
126-
}
127-
},
128-
"key": [{
129-
"type": "pkix-base64-key",
130-
"value": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETKRFE_RwSXooI8DdatPOYg_uiKm2XrtT_uEMEvqQZrwJHHcfw0c3WVzGoqL3Y_Q6xkHFfdUVqS2WWkPdKO03uw=="
131-
}]
132-
}
133-
]
134-
}
135-
```
136-
137-
3. Complex Example (with special characters):
138-
```json
139-
{
140-
"comid.verification-keys": [
141-
{
142-
"environment": {
143-
"class": {
144-
"id": {
145-
"class-id": "cd1f0e55-26f9-460d-b9d8-f7fde171787c"
146-
},
147-
"vendor": "Company & Co., Ltd.",
148-
"model": "TPM.v2-Enhanced+"
149-
},
150-
"instance": {
151-
"instance-id": {
152-
"type": "ueid",
153-
"value": "AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
154-
}
155-
}
156-
},
157-
"key": [{
158-
"type": "pkix-base64-key",
159-
"value": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETKRFE_RwSXooI8DdatPOYg_uiKm2XrtT_uEMEvqQZrwJHHcfw0c3WVzGoqL3Y_Q6xkHFfdUVqS2WWkPdKO03uw=="
160-
}]
161-
}
162-
]
163-
}
164-
```
165-
166-
### Security Considerations
167-
168-
When using vendor and model fields:
169-
170-
1. **Input Validation**:
171-
- Maximum length: 1024 characters
172-
- Strings are trimmed of leading/trailing whitespace
173-
- Basic sanitization is applied to prevent injection attacks
174-
- Control characters are removed (except newline and tab)
175-
176-
2. **Storage**:
177-
- Fields are optional and won't affect TPM validation
178-
- Unicode characters are preserved for international vendor names
179-
- Dangerous characters are escaped to prevent injection
180-
181-
3. **Best Practices**:
182-
- Use consistent vendor/model identifiers
183-
- Prefer official vendor names and model numbers
184-
- Keep strings concise and meaningful
185-
- Test with various character encodings if using international names
186-
187-
Note: The vendor and model fields are always optional and are meant for informational purposes only. The TPM's security validation is based solely on its cryptographic identity and measurements.
188-
```
189-
```

‎scheme/parsec-tpm/corim_extractor.go‎

Lines changed: 27 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"encoding/json"
77
"errors"
88
"fmt"
9-
"strings"
109

1110
"github.com/veraison/corim/comid"
1211
"github.com/veraison/eat"
@@ -40,19 +39,19 @@ func (o CorimExtractor) RefValExtractor(
4039
return nil, fmt.Errorf("measurement[%d]: %w", i, err)
4140
}
4241

43-
for j, digest := range digests {
44-
attrs, err := makeRefValAttrs(id.class, pcr, digest)
45-
if err != nil {
46-
return nil, fmt.Errorf("measurement[%d].digest[%d]: %w", i, j, err)
47-
}
48-
49-
refval = &handler.Endorsement{
50-
Scheme: SchemeName,
51-
Type: handler.EndorsementType_REFERENCE_VALUE,
52-
Attributes: attrs,
53-
}
42+
for j, digest := range digests {
43+
attrs, err := makeRefValAttrs(id.class, pcr, digest, rv.Environment)
44+
if err != nil {
45+
return nil, fmt.Errorf("measurement[%d].digest[%d]: %w", i, j, err)
46+
}
47+
48+
refval = &handler.Endorsement{
49+
Scheme: SchemeName,
50+
Type: handler.EndorsementType_REFERENCE_VALUE,
51+
Attributes: attrs,
5452
}
55-
refVals = append(refVals, refval)
53+
}
54+
refVals = append(refVals, refval)
5655
}
5756
}
5857

@@ -96,14 +95,26 @@ func (o CorimExtractor) TaExtractor(
9695
return ta, nil
9796
}
9897

99-
func makeRefValAttrs(class string, pcr uint64, digest swid.HashEntry) (json.RawMessage, error) {
98+
func makeRefValAttrs(class string, pcr uint64, digest swid.HashEntry, env comid.Environment) (json.RawMessage, error) {
10099

101100
var attrs = map[string]interface{}{
102101
"parsec-tpm.class-id": class,
103102
"parsec-tpm.pcr": pcr,
104103
"parsec-tpm.digest": digest.HashValue,
105104
"parsec-tpm.alg-id": digest.HashAlgID,
106105
}
106+
107+
// Extract optional vendor and model from environment.class
108+
// Following CoRIM specification - vendor/model are stored in environment, not key parameters
109+
if env.Class != nil {
110+
if env.Class.Vendor != nil {
111+
attrs["parsec-tpm.vendor"] = string(*env.Class.Vendor)
112+
}
113+
if env.Class.Model != nil {
114+
attrs["parsec-tpm.model"] = string(*env.Class.Model)
115+
}
116+
}
117+
107118
data, err := json.Marshal(attrs)
108119
if err != nil {
109120
return nil, fmt.Errorf("unable to marshal reference value attributes: %w", err)
@@ -126,20 +137,10 @@ func makeTaAttrs(id ID, key *comid.CryptoKey, env comid.Environment) (json.RawMe
126137
// Following CoRIM specification - vendor/model are stored in environment, not key parameters
127138
if env.Class != nil {
128139
if env.Class.Vendor != nil {
129-
vendor := string(*env.Class.Vendor)
130-
// Trim and validate
131-
vendor = sanitizeAndValidate(vendor)
132-
if vendor != "" {
133-
attrs["parsec-tpm.vendor"] = vendor
134-
}
140+
attrs["parsec-tpm.vendor"] = string(*env.Class.Vendor)
135141
}
136142
if env.Class.Model != nil {
137-
model := string(*env.Class.Model)
138-
// Trim and validate
139-
model = sanitizeAndValidate(model)
140-
if model != "" {
141-
attrs["parsec-tpm.model"] = model
142-
}
143+
attrs["parsec-tpm.model"] = string(*env.Class.Model)
143144
}
144145
}
145146

@@ -210,22 +211,3 @@ func (o *ID) FromEnvironment(e comid.Environment) error {
210211
func (o *CorimExtractor) SetProfile(profile string) {
211212
o.Profile = profile
212213
}
213-
214-
// sanitizeAndValidate trims and validates vendor/model strings
215-
func sanitizeAndValidate(input string) string {
216-
// Trim whitespace
217-
trimmed := strings.TrimSpace(input)
218-
219-
// Check length limit (1024 characters)
220-
if len(trimmed) > 1024 {
221-
return ""
222-
}
223-
224-
// If empty after trimming, return empty
225-
if trimmed == "" {
226-
return ""
227-
}
228-
229-
// Apply sanitization
230-
return sanitizeString(trimmed)
231-
}

‎scheme/parsec-tpm/evidence_handler.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ type SwAttr struct {
2626
ClassID *string `json:"parsec-tpm.class-id"`
2727
Digest *[]byte `json:"parsec-tpm.digest"`
2828
PCR *uint `json:"parsec-tpm.pcr"`
29+
// Optional vendor information for the TPM
30+
Vendor *string `json:"parsec-tpm.vendor,omitempty"`
31+
// Optional model information for the TPM
32+
Model *string `json:"parsec-tpm.model,omitempty"`
2933
}
3034

3135
type Endorsements struct {

0 commit comments

Comments
 (0)