Documentation
¶
Overview ¶
Package kds defines values specified for the AMD Key Distribution Service.
Index ¶
- Variables
- func CrlLinkByKey(productLine string, key abi.ReportSigner) string
- func CrlLinkByRole(productLine, role string) string
- func DefaultProductLine() string
- func DefaultProductString() stringdeprecated
- func ParseProduct(productLine string) (pb.SevProduct_SevProductName, error)deprecated
- func ParseProductCertChain(pems []byte) ([]byte, []byte, error)
- func ParseProductLine(productLine string) (*pb.SevProduct, error)
- func ParseProductName(productName string, key abi.ReportSigner) (*pb.SevProduct, error)
- func ProductCertChainURL(s abi.ReportSigner, productLine string) string
- func ProductLine(product *pb.SevProduct) string
- func ProductLineOfProductName(productNameOrProductLine string) string
- func ProductName(product *pb.SevProduct) string
- func ProductString(product *pb.SevProduct) stringdeprecated
- func TCBPartsLE(tcb0, tcb1 TCBParts) bool
- func VCEKCertURL(productLine string, hwid []byte, tcb TCBVersion) string
- func VLEKCertURL(productLine string, tcb TCBVersion) string
- type CertFunction
- type Extensions
- type TCBParts
- type TCBVersion
- type VCEKCert
- type VLEKCert
Constants ¶
This section is empty.
Variables ¶
var ( // OidStructVersion is the x509v3 extension for V[CL]EK certificate struct version. OidStructVersion = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 1}) // OidProductName1 is the x509v3 extension for V[CL]EK certificate product name. OidProductName1 = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 2}) // OidBlSpl is the x509v3 extension for V[CL]EK certificate bootloader security patch level. OidBlSpl = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 3, 1}) // OidTeeSpl is the x509v3 extension for V[CL]EK certificate TEE security patch level. OidTeeSpl = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 3, 2}) // OidSnpSpl is the x509v3 extension for V[CL]EK certificate SNP security patch level. OidSnpSpl = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 3, 3}) // OidSpl4 is the x509v3 extension for V[CL]EK certificate reserved security patch level. OidSpl4 = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 3, 4}) // OidSpl5 is the x509v3 extension for V[CL]EK certificate reserved security patch level. OidSpl5 = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 3, 5}) // OidSpl6 is the x509v3 extension for V[CL]EK certificate reserved security patch level. OidSpl6 = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 3, 6}) // OidSpl7 is the x509v3 extension for V[CL]EK certificate reserved security patch level. OidSpl7 = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 3, 7}) // OidUcodeSpl is the x509v3 extension for V[CL]EK microcode security patch level. OidUcodeSpl = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 3, 8}) // OidHwid is the x509v3 extension for VCEK certificate associated hardware identifier. OidHwid = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 4}) // OidCspID is the x509v3 extension for a VLEK certificate's Cloud Service Provider's // origin TLS key's certificate's subject key's CommonName. OidCspID = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 3704, 1, 5}) )
Functions ¶
func CrlLinkByKey ¶ added in v0.8.0
func CrlLinkByKey(productLine string, key abi.ReportSigner) string
CrlLinkByKey returns the CRL distribution point for the given key type's product. If key is VlekReportSigner, then we use the vlek endpoint. The ASK and ARK are both on the vcek endpoint.
func CrlLinkByRole ¶ added in v0.8.0
CrlLinkByRole returns the CRL distribution point for the given key role's product. If role is "ASVK", then we use the vlek endpoint. The ASK and ARK are both on the vcek endpoint.
func DefaultProductLine ¶ added in v0.11.1
func DefaultProductLine() string
DefaultProductLine returns the product line of the default SEV product.
func DefaultProductString
deprecated
added in
v0.9.2
func DefaultProductString() string
DefaultProductString returns the product line of the default SEV product.
Deprecated: Use DefaultProductLine()
func ParseProduct
deprecated
added in
v0.9.2
func ParseProduct(productLine string) (pb.SevProduct_SevProductName, error)
ParseProduct returns the SevProductName for a product name without the stepping suffix.
Deprecated: Use ParseProductLine
func ParseProductCertChain ¶
ParseProductCertChain returns the DER-formatted certificates represented by the body of the ProductCertChain (cert_chain) endpoint, ASK and ARK in that order.
func ParseProductLine ¶ added in v0.11.1
func ParseProductLine(productLine string) (*pb.SevProduct, error)
ParseProductLine returns the SevProductName for a product name without the stepping suffix.
func ParseProductName ¶ added in v0.7.1
func ParseProductName(productName string, key abi.ReportSigner) (*pb.SevProduct, error)
ParseProductName returns the KDS project input value, and the model, stepping numbers represented by a given V[CL]EK productName extension value, or an error.
func ProductCertChainURL ¶
func ProductCertChainURL(s abi.ReportSigner, productLine string) string
ProductCertChainURL returns the AMD KDS URL for retrieving the ARK and AS(V)K certificates on the given product in ??? format.
func ProductLine ¶ added in v0.11.1
func ProductLine(product *pb.SevProduct) string
ProductLine returns the KDS product argument to use for the product associated with an attestation report proto.
func ProductLineOfProductName ¶ added in v0.11.1
ProductLineOfProductName returns the product represented by productNameOrProductLine, i.e., without the stepping suffix.
func ProductName ¶ added in v0.7.1
func ProductName(product *pb.SevProduct) string
ProductName returns the expected productName extension value for the product associated with an attestation report proto.
func ProductString
deprecated
added in
v0.7.1
func ProductString(product *pb.SevProduct) string
ProductString returns the KDS product argument to use for the product associated with an attestation report proto.
Deprecated: Use ProductLine()
func TCBPartsLE ¶ added in v0.6.2
TCBPartsLE returns true iff all TCB components of tcb0 are <= the corresponding tcb1 components.
func VCEKCertURL ¶
func VCEKCertURL(productLine string, hwid []byte, tcb TCBVersion) string
VCEKCertURL returns the AMD KDS URL for retrieving the VCEK on a given product at a given TCB version. The hwid is the CHIP_ID field in an attestation report.
func VLEKCertURL ¶ added in v0.8.0
func VLEKCertURL(productLine string, tcb TCBVersion) string
VLEKCertURL returns the GET URL for retrieving a VLEK certificate, but without the necessary CSP secret in the HTTP headers that makes the request validate to the KDS.
Types ¶
type CertFunction ¶ added in v0.8.0
type CertFunction int
CertFunction is an enumeration of which endorsement key type is getting certified.
const ( // UnknownCertFunction represents an unknown endpoint for parsing KDS URLs. UnknownCertFunction CertFunction = iota // VcekCertFunction represents the vcek endpoints for parsing KDS URLs. VcekCertFunction // VlekCertFunction represents the vlek endpoints for parsing KDS URLs. VlekCertFunction )
func ParseProductCertChainURL ¶ added in v0.4.0
func ParseProductCertChainURL(kdsurl string) (string, CertFunction, error)
ParseProductCertChainURL returns the product name and either "vcek" or "vlek" for a KDS cert_chain url, or an error if the input is not a KDS cert_chain url.
type Extensions ¶ added in v0.8.0
type Extensions struct {
StructVersion uint8
ProductName string
// The host driver knows the difference between primary and secondary HWID.
// Primary vs secondary is irrelevant to verification. Must be nil or
// abi.ChipIDSize long.
HWID []byte
TCBVersion TCBVersion
CspID string
}
Extensions represents the information stored in the KDS-specified x509 extensions of a V{C,L}EK certificate.
func CertificateExtensions ¶ added in v0.8.0
func CertificateExtensions(cert *x509.Certificate, key abi.ReportSigner) (*Extensions, error)
CertificateExtensions returns the x509v3 extensions from the KDS specification interpreted into a struct type.
func VcekCertificateExtensions ¶
func VcekCertificateExtensions(cert *x509.Certificate) (*Extensions, error)
VcekCertificateExtensions returns the x509v3 extensions from the KDS specification of a VCEK certificate interpreted into a struct type.
func VlekCertificateExtensions ¶ added in v0.8.0
func VlekCertificateExtensions(cert *x509.Certificate) (*Extensions, error)
VlekCertificateExtensions returns the x509v3 extensions from the KDS specification of a VLEK certificate interpreted into a struct type.
type TCBParts ¶
type TCBParts struct {
// BlSpl is the bootloader security patch level.
BlSpl uint8
// TeeSpl is the TEE security patch level.
TeeSpl uint8
// Spl4 is reserved.
Spl4 uint8
// Spl5 is reserved.
Spl5 uint8
// Spl6 is reserved.
Spl6 uint8
// Spl7 is reserved.
Spl7 uint8
// SnpSpl is the SNP security patch level.
SnpSpl uint8
// UcodeSpl is the microcode security patch level.
UcodeSpl uint8
}
TCBParts represents all TCB field values in a given uint64 representation of an AMD secure processor firmware TCB version.
func DecomposeTCBVersion ¶
func DecomposeTCBVersion(tcb TCBVersion) TCBParts
DecomposeTCBVersion interprets the byte components of the AMD representation of the platform security patch levels into a struct.
type TCBVersion ¶
type TCBVersion uint64
TCBVersion is a 64-bit bitfield of different security patch levels of AMD firmware and microcode.
func ComposeTCBParts ¶
func ComposeTCBParts(parts TCBParts) (TCBVersion, error)
ComposeTCBParts returns an SEV-SNP TCB_VERSION from OID mapping values. The spl4-spl7 fields are reserved, but the KDS specification designates them as 4 byte-sized fields.
type VCEKCert ¶ added in v0.4.0
type VCEKCert struct {
// Product is the product string (no stepping value) present in the VCEK cert url
//
// Deprecated: Use ProductLine.
Product string
ProductLine string
HWID []byte
TCB uint64
}
VCEKCert represents the attestation report components represented in a KDS VCEK certificate request URL.
func ParseVCEKCertURL ¶ added in v0.4.0
ParseVCEKCertURL returns the attestation report components represented in the given KDS VCEK certificate request URL.
func VCEKCertProduct ¶ added in v0.11.1
VCEKCertProduct returns a VCEKCert with the product line set to productLine.
type VLEKCert ¶ added in v0.8.0
type VLEKCert struct {
// Product is the product string (no stepping value) present in the VCEK cert url
//
// Deprecated: Use ProductLine.
Product string
ProductLine string
TCB uint64
}
VLEKCert represents the attestation report components represented in a KDS VLEK certificate request URL.
func ParseVLEKCertURL ¶ added in v0.8.0
ParseVLEKCertURL returns the attestation report components represented in the given KDS VLEK certificate request URL.
Source Files