github.com/jlmucb/cloudproxy@v0.0.0-20170830161738-b5aa0b619bc4/Doc/attestation.txt (about)

     1  Statement := [ data, hash_alg, hash, time, exp ]
     2  Attestation := [ type, sstmt, sig, quote, cert ]
     3  
     4  Policy signing key = Kroot
     5  . = missing
     6  
     7  I'm assuming the use of WhitelistAuth, not RootAuth.
     8  
     9  --------
    10  
    11  attest_to_aik calls AttestByRoot which uses Kroot to generate:
    12  
    13    a0 = [type=ROOT,
    14          sstmt=ser([data=aik,
    15                     hash_alg=.,
    16                     hash=.,
    17                     time=when,
    18                     exp=later]),
    19          sig=KeyczarSign(sstmt, Kroot),
    20          quote=.,
    21          cert=.]
    22  
    23  The meaning of ROOT attestation a0 is:
    24  
    25    s0 = "ROOT says _aik_ is a trustworthy system notbefore _when_ notafter _exp_"
    26    where: _aik_ = a0.sstmt.data = aik
    27           _when_ = a0.sstmt.time
    28           _exp_ = a0.sstmt.exp
    29  
    30  Note: I say "trustworthy system" here, rather than "trustworthy tpm". See below.
    31  
    32  Given a0, before we should believe s0, we should check:
    33    KeyczarVerify(a0.sstmt, Kroot) // properly signed by policy key
    34    a0.time <= now <= a0.exp // not expired
    35  
    36  If those conditions hold, then:
    37  
    38    TaoAuth::VerifyAttestation(a0) returns a0.sstmt.data = aik
    39  
    40  --------
    41  
    42  LinuxTao w/ signing key Ktao calls TPMTaoChildChannel which uses TPM to create:
    43  
    44    a1 = [type=TPM_1_2_QUOTE,
    45          sstmt=ser([data=Ktao,
    46                     hash_alg="TPM1.2 Quote",
    47                     hash=.,
    48                     time=when,
    49                     exp=later]),
    50          sig=TpmWierdSign([Ktao, pcrs], aik),
    51          quote=pcrs,
    52          cert=a0]
    53  
    54  Note: The timestamps on a1 are taken from LinuxTao. So the TPM isn't limiting
    55  the attestion, only LinuxTao is putting a time limit on this.
    56  
    57  The meaning of TPM_1_2_QUOTE attestation a1 is:
    58    s1 = "_aik_ says (_linux_ says its key is _k_ notbefore _when_ notafter _exp_)"
    59    where: _aik_ = VerifiyAttestation(a1.cert) = VerifyAttesataion(a0)
    60           _linux_ = a1.quote = pcrs
    61           _k_ = a1.sstmt.data = Ktao
    62           _when_ = a1.sstmt.time
    63           _exp_ = a1.sstmt.exp
    64  
    65  Given a1, before we should believe s1, we should check:
    66    VerifyAttestation(a1.cert=a0) // this tpm is trustworty in this domain
    67    TpmWierdVerify([a1.sstmt.data, a1.quote], _aik_) // properly signed by this tpm
    68    a1.time <= now <= a1.exp // not expired
    69    CheckAuthorization(a1) // checks if pcrs are on the whitelist for this domain
    70  
    71  If those conditions hold, then:
    72  
    73    TaoAuth::VerifyAttestation(a1) returns a1.sstmt.data = Ktao
    74  
    75  --------
    76  
    77  LinuxTao w/ signing key Ktao sends attestations a0 and a1 to TCCA, which does the above
    78  checks to conclude s0 and s1. Given s0 and s1, TCCA makes a logical deduction
    79  then produces:
    80  
    81    a1b = [type=ROOT,
    82          sstmt=ser([data=Ktao,
    83                     hash_alg="TPM1.2 Quote",
    84                     hash=.,
    85                     time=when,
    86                     exp=later]),
    87          sig=KeyczarSign(sstmt, Kroot),
    88          quote=.,
    89          cert=.]
    90  
    91  Note: The timestamps on a1b are copied directly from a1. So TCCA isn't limiting
    92  the attestion, only the original LinuxTao is putting a time limit on this. Seems
    93  kind of risky that LinuxTao can request arbitrary timestamps and TCCA will
    94  happily sign them.
    95  
    96  Note also that the pcrs are completely omitted.
    97  
    98  The meaning of ROOT attestation a1b (following the same pattern as for a0) is:
    99    s1b = "ROOT says _k_ is a trustworthy system notbefore _when_ notafter _exp_"
   100    where: _k_ = a1b.sstmt.data = Ktao
   101           _when_ = a1b.sstmt.time
   102           _exp_ = a1b.sstmt.exp
   103  
   104  Note: I need to say "trustworthy system" here, not "trustworthy tpm". See above.
   105  
   106  Given a1b, before we should believe s1b, we should check:
   107    KeyczarVerify(a1b.sstmt, Kroot) // properly signed by policy key
   108    a0.time <= now <= a0.exp // not expired
   109  
   110  If those conditions hold, then:
   111  
   112    TaoAuth::VerifyAttestation(a1b) returns a1b.sstmt.data = Ktao
   113  
   114  --------
   115  
   116  CloudServer w/ signing key Ksrv and program hash H calls LinuxTao::Attest(H, S).
   117  I'm not positive what S is here, I assume it is a self-signed x509 cert
   118  describing its own public key Ksrv. In any case, LinuxTao checks to make sure H
   119  is actually one of its own running children, then generates:
   120  
   121    a2 = [type=INTERMEDIATE,
   122          sstmt=ser([data=x509(Ksrv),
   123                     hash_alg="SHA256",
   124                     hash=H,
   125                     time=when,
   126                     exp=later]),
   127          sig=KeyczarSign(sstmt, Ktao),
   128          quote=.,
   129          cert=a1b (alternatively, a1a if not using tcca)]
   130  
   131  The meaning of INTERMEDIATE attestation a2 is:
   132  
   133    s2 = "_linux_ says (_pgm_ says its key is _k_) notbefore _when_ notafter _exp_"
   134    where: _linux_ = VerifiyAttestation(a2.cert) = VerifyAttesataion(a1b) = Ktao
   135           _pgm_ = a2.sstmt.hash = H
   136           _k_ = a2.sstmt.data = x509(srv)
   137           _when_ = a2.sstmt.time
   138           _exp_ = a2.sstmt.exp
   139  
   140  Given a1, before we should believe s2, we should check:
   141    VerifyAttestation(a2.cert=a1b) // this linux tao is trustworty in this domain
   142    KeyczarVerify(a2.sstmt.data, _linux_) // properly signed by this linux tao
   143    a2.time <= now <= a2.exp // not expired
   144    CheckAuthorization(a2) // checks if H is on the whitelist for this domain
   145  
   146  If those conditions hold, then:
   147  
   148    TaoAuth::VerifyAttestation(a2) returns a2.sstmt.data = x509(Ksrv)
   149  
   150  I suppose CloudServer could also go to TCC with a1b and a2 to get a condensed
   151  cert in the same way that LinuxTao did, but I don't think the code currently
   152  does that.
   153  
   154  --------
   155  
   156  Comments:
   157  
   158  It seems that the intended meaning of an attestation is always
   159  
   160    "The following key is owned by some trustworthy system and is to be trusted
   161    for signing additional attestations"
   162  
   163    Where "some trustworthy system" means 
   164    "either a tpm that was OK'ed by the policy, 
   165    or a linux system running on such a tpm with pcrs in a state that was OK'ed by the policy,
   166    or a hosted program runnning on such a linux system with hash that was OK'ed by the policy"
   167  
   168  First issue: The checking and logical deduction seems really liberal. It seems
   169  that an attested hosted program has exactly the same powers as an attested linux
   170  tao. For example, I don't see anything that prevents a hosted program from
   171  issuing the same kinds of attestations that the linux tao does, meaning that a
   172  hosted program on the whitelist can impersonate any other name on the whitelist.
   173  Similarly, CloudClients can impersonate CloudServers by just issuing their own
   174  attestations binding the server hash to their own keys.
   175  
   176  Second issue: Actually, it seems to me that program names are *never* used,
   177  except when LinuxTao wants to decide whether to start a given hosted program.