Skip to content

feat!(attestation): report the DCAP collateral a verification consumed #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
samlaf wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat!(attestation): report the DCAP collateral a verification consumed #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6ab5e69
attestation!: report the DCAP collateral a verification consumed
samlaf Aug 24, 2026
baca4a1
attestation!: bind the collateral to the instant it was held to
samlaf Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 35 additions & 17 deletions crates/attestation/src/azure/verify.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ use super::{
unix_time_now_secs,
};
use crate::{
AttestationResult,
dcap::{
verify_dcap_attestation_with_given_timestamp,
verify_dcap_attestation_with_timestamp_sync,
Expand All @@ -43,7 +44,7 @@ pub async fn verify_azure_attestation(
expected_input_data: [u8; 64],
pccs: Option<Pccs>,
override_azure_outdated_tcb: bool,
) -> Result<MultiMeasurements, MaaError> {
) -> Result<AttestationResult, MaaError> {
let now = unix_time_now_secs()?;

verify_azure_attestation_with_given_timestamp(
Expand All @@ -67,7 +68,7 @@ pub fn verify_azure_attestation_sync(
expected_input_data: [u8; 64],
pccs: Pccs,
override_azure_outdated_tcb: bool,
) -> Result<MultiMeasurements, MaaError> {
) -> Result<AttestationResult, MaaError> {
let now = unix_time_now_secs()?;

verify_azure_attestation_with_given_timestamp_sync(
Expand All @@ -90,7 +91,7 @@ async fn verify_azure_attestation_with_given_timestamp(
collateral: Option<QuoteCollateralV3>,
now: u64,
override_azure_outdated_tcb: bool,
) -> Result<MultiMeasurements, MaaError> {
) -> Result<AttestationResult, MaaError> {
let PreparedAzureAttestation {
tdx_quote_bytes,
hcl_report,
Expand All @@ -99,7 +100,7 @@ async fn verify_azure_attestation_with_given_timestamp(
tpm_attestation,
} = prepare_azure_attestation(input)?;

let _dcap_measurements = verify_dcap_attestation_with_given_timestamp(
let AttestationResult { quote, collateral, .. } = verify_dcap_attestation_with_given_timestamp(
tdx_quote_bytes,
expected_tdx_input_data,
pccs,
Expand All @@ -109,13 +110,14 @@ async fn verify_azure_attestation_with_given_timestamp(
)
.await?;

finish_azure_attestation_verification(
let measurements = finish_azure_attestation_verification(
hcl_report,
var_data_hash,
tpm_attestation,
expected_input_data,
now,
)
)?;
Ok(AttestationResult { measurements, quote, collateral })
}

/// Synchronous version of the verifier
Expand All @@ -126,7 +128,7 @@ fn verify_azure_attestation_with_given_timestamp_sync(
collateral: Option<QuoteCollateralV3>,
now: u64,
override_azure_outdated_tcb: bool,
) -> Result<MultiMeasurements, MaaError> {
) -> Result<AttestationResult, MaaError> {
let PreparedAzureAttestation {
tdx_quote_bytes,
hcl_report,
Expand All @@ -135,7 +137,7 @@ fn verify_azure_attestation_with_given_timestamp_sync(
tpm_attestation,
} = prepare_azure_attestation(input)?;

let _dcap_measurements = verify_dcap_attestation_with_timestamp_sync(
let AttestationResult { quote, collateral, .. } = verify_dcap_attestation_with_timestamp_sync(
tdx_quote_bytes,
expected_tdx_input_data,
pccs,
Expand All @@ -144,13 +146,14 @@ fn verify_azure_attestation_with_given_timestamp_sync(
override_azure_outdated_tcb,
)?;

finish_azure_attestation_verification(
let measurements = finish_azure_attestation_verification(
hcl_report,
var_data_hash,
tpm_attestation,
expected_input_data,
now,
)
)?;
Ok(AttestationResult { measurements, quote, collateral })
}

/// Parses the attestation during verification
Expand Down Expand Up @@ -341,7 +344,10 @@ impl RsaPubKey {

#[cfg(test)]
mod tests {
use dcap_qvl::QuoteCollateralV3;

use super::{super::MAX_AZURE_ATTESTATION_PAYLOAD_SIZE, *};
use crate::CollateralSnapshot;

fn input_data_from_attestation(attestation_bytes: &[u8]) -> [u8; 64] {
let attestation_document: AttestationDocument =
Expand Down Expand Up @@ -456,31 +462,43 @@ mod tests {
assert_eq!(attestation_document.tpm_attestation.ak_intermediate_certificates_pem.len(), 2);

let attestation_json = serde_json::to_vec(&attestation_document).unwrap();
let async_collateral = serde_saphyr::from_slice(collateral_bytes).unwrap();
let sync_collateral = serde_saphyr::from_slice(collateral_bytes).unwrap();

let async_measurements = verify_azure_attestation_with_given_timestamp(
let fixture_collateral: QuoteCollateralV3 =
serde_saphyr::from_slice(collateral_bytes).unwrap();

let AttestationResult {
measurements: async_measurements,
collateral: async_collateral,
..
} = verify_azure_attestation_with_given_timestamp(
attestation_json.clone(),
[0; 64],
None,
Some(async_collateral),
Some(fixture_collateral.clone()),
now,
false,
)
.await
.unwrap();

let sync_measurements = verify_azure_attestation_with_given_timestamp_sync(
let AttestationResult {
measurements: sync_measurements, collateral: sync_collateral, ..
} = verify_azure_attestation_with_given_timestamp_sync(
attestation_json,
[0; 64],
Pccs::new_without_prewarm(None),
Some(sync_collateral),
Some(fixture_collateral.clone()),
now,
false,
)
.unwrap();

assert_eq!(async_measurements, sync_measurements);
// The bundle handed back is the one the verification consumed, which
// is what makes archiving it provenance rather than a second copy,
// and it arrives paired with the instant it was held to
let expected = CollateralSnapshot { collateral: fixture_collateral, at: now };
assert_eq!(async_collateral, expected);
assert_eq!(sync_collateral, expected);
}

#[tokio::test]
Expand Down
Loading
Loading