Add SEVSNP plugin for Veraison server #333

jraman567 · 2025-09-03T15:52:38Z

This PR implements the SEVSNP scheme for Veraison.

RATSd needs golang version 1.23.0 or newer as it depends on CMW (https://github.com/veraison/cmw), which needs 1.23.0 or newer. The services repo needs RATSd. Therefore, set the minimum golang version to 1.23.0 Signed-off-by: Jagannathan Raman <[email protected]>

define SEV-SNP scheme for Veraison. Switch to CoRIM version v1.1.3-0.20250307044607-0bbdd6c78526 Signed-off-by: Jagannathan Raman <[email protected]> fix(sensnp+rpm): add SEV-SNP plugin to package

store the trust anchors and reference values in the CoMID's "Attest Key Triple" and "Reference Value Triple" formats. Signed-off-by: Jagannathan Raman <[email protected]>

accept CoRIM endorsements, reference values & trust anchors, and save them in the database. Signed-off-by: Jagannathan Raman <[email protected]>

implement parts of the store handler that synthesize keys from trust anchors and reference values. Signed-off-by: Jagannathan Raman <[email protected]>

Implement an evidence handler to extract claims from the evidence token and store them in an internal representation format ( CoRIM for SEV-SNP). Additionally, implement the GetLevel interface for HCLogger, which was introduced with v1.5.0. Signed-off-by: Jagannathan Raman <[email protected]>

Update the store handler to get Trust Anchor and Reference Value keys from evidence. Add helper routines to parse the TSM report's auxblob to extract AMD keys. Signed-off-by: Jagannathan Raman <[email protected]>

Implement the ValidateEvidenceIntegrity routine of the EvidenceHandler interface. Ensure the root key in auxblob matches the ARK in provisioned trust anchors. Confirm the integrity of the certificate chain in the auxblob and the validity of the signature in the evidence. Signed-off-by: Jagannathan Raman <[email protected]>

Implement the AppraiseEvidence routine in the EvidenceHandler interface to confirm the claims match with the evidence. Signed-off-by: Jagannathan Raman <[email protected]>

Add unit tests for endorsement, evidence and storage handlers Signed-off-by: Jagannathan Raman <[email protected]>

Add README document for SEVSNP scheme Signed-off-by: Jagannathan Raman <[email protected]>

Update the CMW module to enable CMW collection support Signed-off-by: Jagannathan Raman <[email protected]>

Update go-sev-guest to get fix for Genoa VCEK handling Signed-off-by: Jagannathan Raman <[email protected]>

Allow SEVSNP scheme to accept evidence in CMW collection format Signed-off-by: Jagannathan Raman <[email protected]>

REPORTED_TCB is a bitfield of versions. Extract individual versions for comparison. REPORTED_TCB in evidence should be greater than or equal to the reference value. Signed-off-by: Jagannathan Raman <[email protected]>

Some claims in the SEV-SNP profile aren't relevant for verification, so skipping them Signed-off-by: Jagannathan Raman <[email protected]>

scheme/sevsnp/README.md

scheme/sevsnp/common.go

yogeshbdeshpande · 2025-09-26T14:58:30Z

scheme/sevsnp/common.go

+
+	block, _ := pem.Decode(cert)
+	if block == nil || block.Type != "CERTIFICATE" {
+		return nil, fmt.Errorf("failed to read certificate")


Suggested change

return nil, fmt.Errorf("failed to read certificate")

return nil, errors.New("failed to read certificate")

scheme/sevsnp/common.go

yogeshbdeshpande · 2025-09-26T15:00:40Z

scheme/sevsnp/common.go

+		tcbParts   kds.TCBParts
+	)
+
+	// ToDo: following is a circuitous way to obtain the 64-bit TCB integer value


If this is a genuine TO DO, preferably create an issue and tag the issue here, please!

yogeshbdeshpande · 2025-09-26T15:03:54Z

scheme/sevsnp/evidence_handler.go

+		return nil, err
+	}
+
+	refValCorim := corim.UnsignedCorim{}


just check, if we need to initialise other mandatory part of CoRIM here as well...

yogeshbdeshpande

in middle of review, just started today

Co-authored-by: Yogesh Deshpande <[email protected]>

yogeshbdeshpande · 2025-09-30T10:52:56Z

As we are adding new scheme, please refer to https://github.com/veraison/services/blob/main/README.md

Insert Sev-snp support in the suitable place for the text pertaining to Provisioning
Insert Sev-snp support in the suitable place for the text pertaining to Verification

Also remember to check the suitable places in docs repo and the Veraison book, to check where this comment is applicable.

yogeshbdeshpande

Left some further comments.

yogeshbdeshpande · 2025-09-30T10:56:31Z

scheme/sevsnp/common.go

+	return block.Bytes, nil
+}
+
+func parseAttestationToken(token *proto.AttestationToken) (*tokens.TSMReport, error) {


Just a question, perhaps need a better place to ask, is there a place, where, we say, the supported Media Types for Evidence are 1. TSM in CBOR, 2. TSM in JSON 3. RATSD in JSON ..?

Hi @yogeshbdeshpande, are you asking where they are documented?

tsm-report's CDDL is here: https://github.com/veraison/ratsd/blob/main/docs/tsm-report.cddl

TSM in CBOR is recorded here: https://www.iana.org/assignments/media-types/application/vnd.veraison.tsm-report+cbor

I couldn't find the IANA doc for the other two. I'll check with @thomas-fossati on how to get them.

Besides we have this godoc: https://pkg.go.dev/github.com/veraison/ratsd/attesters/tsm

I couldn't find the IANA doc for the other two. I'll check with @thomas-fossati on how to get them.

TSM in JSON is recorded here: https://www.iana.org/assignments/media-types/application/vnd.veraison.tsm-report+json

RATSd evidence top-level formats are explored here: veraison/ratsd#27

Thank you, @thomas-fossati.

yogeshbdeshpande · 2025-09-30T11:17:16Z

scheme/sevsnp/evidence_handler.go

+	result := handler.CreateAttestationResult(SchemeName)
+
+	appraisal := result.Submods[SchemeName]
+


Just a question: Is this init to default values or more than this..?
Can you please specify, perhaps a short comment might help as well!

yogeshbdeshpande · 2025-09-30T11:18:27Z

scheme/sevsnp/evidence_handler.go

+		// - POLICY ToDo: Do we need to test individual policy features?
+		// - CURRENT_TCB is informational only. It's best handled by policy
+		// - PLATFORM_INFO ToDO: Do we need to test individual platform features?
+		// - REPORT_DATA is a nonce supplied by user for freshness, not applicable for verification


Suggested change

// - REPORT_DATA is a nonce supplied by user for freshness, not applicable for verification

// - REPORT_DATA is a nonce supplied by user for freshness, this is verified prior at a suitable point- functon-name()

yogeshbdeshpande · 2025-09-30T11:20:12Z

scheme/sevsnp/evidence_handler.go

+		// - REPORT_DATA is a nonce supplied by user for freshness, not applicable for verification
+		// - REPORT_ID is ephemeral, so we can't use it for verification.
+		// - REPORT_ID_MA is also ephemeral, used for migration
+		// - CHIP_ID is unique to an specific attester, but reference values could be used more generally


Just a question:

Does the CHIP_ID maps to a specific instance of platform??? If Yes, shall we not populate the InstanceID Claims..

yogeshbdeshpande · 2025-09-30T11:23:05Z

scheme/sevsnp/evidence_handler.go

+		//     ToDo: It is a good idea to test it anyway, but the Version type only tests for
+		//     equality, and this would trigger spurious failures
+		// - COMMITTED_TCB is informational, used by the host to advance REPORTED_TCB
+		if k == mKeyPolicy ||


I have a question here. Should we not expect a definite set of MKeys and check for their presence here or somewhere earlier to report a fail, if a mandatory MKey is missing from Evidence?
Does this happen intrinsically inside the Evidence Decoding, then it is fine, but just checking...

yogeshbdeshpande · 2025-09-30T11:25:42Z

scheme/sevsnp/evidence_handler.go

+				break claimsLoop
+			}
+			if !compareTcb(*reportedTcb, *em) {
+				// ToDo: Is this a failure condition?


Note: Each of these failures should be represented in the corresponding flag inside the TrustVector for Platform ? If not please check and raise a bug on AR4SI if something fundamental missing in the spec..

yogeshbdeshpande · 2025-09-30T11:28:57Z

scheme/sevsnp/evidence_handler_test.go

+	0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19, 0x18,
+}
+
+func Test_ExtractClaims_ok(t *testing.T) {


Just checking, I did not see the Full Evidence JSON Claims set in the test cases..?

is there any reason for this..?

yogeshbdeshpande · 2025-09-30T11:31:53Z

scheme/sevsnp/evidence_handler_test.go

+	require.NoError(t, err)
+}
+
+func Test_ValidateEvidenceIntegrity_ok(t *testing.T) {


Also, I saw three types of Evidence Format in the code, but I see ONLY tests with RATSD Token only,

Can you please add the test cases for TSM Report in JSON and CBOR as well ?

yogeshbdeshpande · 2025-09-30T11:36:32Z

Also, I feel somewhere in the documentation of the Scheme, we should refer to the documentation on the Evidence Profile and also preferably the Reference Value Profile document, we have used to build this scheme!

thomas-fossati

Thanks, this is great.

I have left a few comments inline.

thomas-fossati · 2025-09-30T15:17:38Z

scheme/sevsnp/README.md

+
+It doesn't need any specific install instructions, it gets deployed along with other schemes.
+```
+make really-clean; make native-deploy


Just a couple of non-blocking notes:

You can supply more than one target when invoking make:

make really-clean native-deploy

The ; will not stop updating native-deploy if really-clean fails, which is not what you want. Instead:

make really-clean && make native-deploy

thomas-fossati · 2025-09-30T15:19:44Z

scheme/sevsnp/README.md

+Since ratsd is under construction, please use the following instance of evcli to submit evidence.
+https://github.com/jraman567/evcli


More fancy linking:

Suggested change

Since ratsd is under construction, please use the following instance of evcli to submit evidence.

https://github.com/jraman567/evcli

Since ratsd is under construction, please use the following [fork of evcli](https://github.com/jraman567/evcli) to submit Evidence.

thomas-fossati · 2025-09-30T15:21:10Z

scheme/sevsnp/README.md

+
+## Usage example
+
+Following is an example of how to interface with this scheme/plugin. The workflow involves using cocli to submit reference values and ratsd to submit the evidence.


Suggested change

Following is an example of how to interface with this scheme/plugin. The workflow involves using cocli to submit reference values and ratsd to submit the evidence.

Following is an example of how to interface with this scheme/plugin. The workflow involves using cocli to submit Reference Values and [ratsd](https://github.com/veraison/ratsd) to submit Evidence.

thomas-fossati · 2025-09-30T15:22:49Z

scheme/sevsnp/README.md

+Generating reference values and evidence is beyond this project's scope. Please see go-gen-ref for creating reference values for SEV-SNP; RATSd generates evidence.
+go-gen-ref: https://github.com/jraman567/go-gen-ref
+ratsd: https://github.com/veraison/ratsd


Suggested change

Generating reference values and evidence is beyond this project's scope. Please see go-gen-ref for creating reference values for SEV-SNP; RATSd generates evidence.

go-gen-ref: https://github.com/jraman567/go-gen-ref

ratsd: https://github.com/veraison/ratsd

Generating Reference Values and Evidence is beyond this project's scope. Please see [go-gen-ref](https://github.com/jraman567/go-gen-ref) for creating Reference Values for SEV-SNP; ratsd generates Evidence.

thomas-fossati · 2025-09-30T15:24:37Z

scheme/sevsnp/README.md

+```
+
+## Attestation Result
+The result is in JWT format. Decoding it using an online tool like https://jwt.io/ reveals formatted results. The trustworthiness vector, as shown below, summarizes the result of verification.


Can’t we use arc to verify and print the TV?

thomas-fossati · 2025-09-30T16:35:10Z

scheme/sevsnp/evidence_handler.go

+	}
+
+	if evM.Val.SVN == nil {
+		log.Errorf("evidence doesn't have SVN")


thomas-fossati · 2025-09-30T16:40:16Z

scheme/sevsnp/evidence_handler.go

+		switch k {
+		case mKeyReportedTcb:
+			if !compareTcb(m, *em) {
+				err = fmt.Errorf("reported TCB in evidence doesn't match reference")


please, use errors.New()

thomas-fossati · 2025-09-30T16:40:36Z

scheme/sevsnp/store_handler.go

+	}
+
+	if len(extractedComid.Triples.ReferenceValues.Values) > 1 {
+		return nil, fmt.Errorf("unable to process multiple claims in evidence")


please, use errors.New()

thomas-fossati · 2025-09-30T16:41:03Z

scheme/sevsnp/store_handler.go

+
+	keyBlock, _ := pem.Decode([]byte(ark.String()))
+	if keyBlock == nil || keyBlock.Type != "CERTIFICATE" {
+		return nil, fmt.Errorf("failed to decode ARK")


usual errors.New() comment :-)

thomas-fossati · 2025-09-30T16:41:31Z

scheme/sevsnp/store_handler.go

+	}
+
+	if m == nil {
+		return "", fmt.Errorf("measurement not found")


Suggested change

return "", fmt.Errorf("measurement not found")

return "", errors.New("measurement not found")

jraman567 requested review from setrofim, thomas-fossati and yogeshbdeshpande September 3, 2025 15:52

jraman567 mentioned this pull request Sep 3, 2025

Add SEVSNP plugin for Veraison server #307

Closed

jraman567 force-pushed the upstream/sevsnp branch from 193c7ed to f0bc831 Compare September 3, 2025 18:13

jraman567 added 16 commits September 3, 2025 14:38

feat(scheme): create plugin for AMD SEV-SNP

65e18bc

define SEV-SNP scheme for Veraison. Switch to CoRIM version v1.1.3-0.20250307044607-0bbdd6c78526 Signed-off-by: Jagannathan Raman <[email protected]> fix(sensnp+rpm): add SEV-SNP plugin to package

feat(sevsnp): implement endorsement extractor

a83a70b

store the trust anchors and reference values in the CoMID's "Attest Key Triple" and "Reference Value Triple" formats. Signed-off-by: Jagannathan Raman <[email protected]>

feat(sevsnp): implement an endorsement handler

56aa648

accept CoRIM endorsements, reference values & trust anchors, and save them in the database. Signed-off-by: Jagannathan Raman <[email protected]>

feat(sevsnp): implement the store handler

3678241

implement parts of the store handler that synthesize keys from trust anchors and reference values. Signed-off-by: Jagannathan Raman <[email protected]>

feat(sevsnp): get keys from evidence

de5d21d

Update the store handler to get Trust Anchor and Reference Value keys from evidence. Add helper routines to parse the TSM report's auxblob to extract AMD keys. Signed-off-by: Jagannathan Raman <[email protected]>

feat(sevsnp): appraise the evidence

ec95f9f

Implement the AppraiseEvidence routine in the EvidenceHandler interface to confirm the claims match with the evidence. Signed-off-by: Jagannathan Raman <[email protected]>

sevsnp tests: add unit tests

6c1be6d

Add unit tests for endorsement, evidence and storage handlers Signed-off-by: Jagannathan Raman <[email protected]>

sevsnp: Add README

5ce5f7b

Add README document for SEVSNP scheme Signed-off-by: Jagannathan Raman <[email protected]>

cmw: update CMW module to enable collections support

c56c7eb

Update the CMW module to enable CMW collection support Signed-off-by: Jagannathan Raman <[email protected]>

fix(go-sev-guest): update go-sev-guest to get Genoa fix

0be59d6

Update go-sev-guest to get fix for Genoa VCEK handling Signed-off-by: Jagannathan Raman <[email protected]>

feat(sevsnp): allow CMW collection evidence type

5dcb7e7

Allow SEVSNP scheme to accept evidence in CMW collection format Signed-off-by: Jagannathan Raman <[email protected]>

fix(sevsnp): update matching of REPORTED_TCB

2f47be8

REPORTED_TCB is a bitfield of versions. Extract individual versions for comparison. REPORTED_TCB in evidence should be greater than or equal to the reference value. Signed-off-by: Jagannathan Raman <[email protected]>

fix(sevsnp): skip unused claims

80ddda3

Some claims in the SEV-SNP profile aren't relevant for verification, so skipping them Signed-off-by: Jagannathan Raman <[email protected]>

jraman567 force-pushed the upstream/sevsnp branch from f0bc831 to 80ddda3 Compare September 3, 2025 18:38

yogeshbdeshpande reviewed Sep 26, 2025

View reviewed changes

scheme/sevsnp/README.md Outdated Show resolved Hide resolved

yogeshbdeshpande reviewed Sep 26, 2025

View reviewed changes

scheme/sevsnp/README.md Outdated Show resolved Hide resolved

yogeshbdeshpande reviewed Sep 26, 2025

View reviewed changes

scheme/sevsnp/README.md Outdated Show resolved Hide resolved

yogeshbdeshpande reviewed Sep 26, 2025

View reviewed changes

scheme/sevsnp/common.go Outdated Show resolved Hide resolved

yogeshbdeshpande reviewed Sep 26, 2025

View reviewed changes

scheme/sevsnp/common.go Outdated Show resolved Hide resolved

yogeshbdeshpande reviewed Sep 26, 2025

View reviewed changes

jraman567 and others added 5 commits September 29, 2025 10:20

Update scheme/sevsnp/README.md

27c820f

Co-authored-by: Yogesh Deshpande <[email protected]>

Update scheme/sevsnp/README.md

dadd96a

Co-authored-by: Yogesh Deshpande <[email protected]>

Update scheme/sevsnp/README.md

6291aef

Co-authored-by: Yogesh Deshpande <[email protected]>

Update scheme/sevsnp/common.go

8a8ed8a

Co-authored-by: Yogesh Deshpande <[email protected]>

Update scheme/sevsnp/common.go

a050ee6

Co-authored-by: Yogesh Deshpande <[email protected]>

yogeshbdeshpande reviewed Sep 30, 2025

View reviewed changes

thomas-fossati reviewed Sep 30, 2025

View reviewed changes

	return nil, fmt.Errorf("failed to read certificate")
	return nil, errors.New("failed to read certificate")

		result := handler.CreateAttestationResult(SchemeName)

		appraisal := result.Submods[SchemeName]

	// - REPORT_DATA is a nonce supplied by user for freshness, not applicable for verification
	// - REPORT_DATA is a nonce supplied by user for freshness, this is verified prior at a suitable point- functon-name()

		Since ratsd is under construction, please use the following instance of evcli to submit evidence.
		https://github.com/jraman567/evcli


		## Usage example

		Following is an example of how to interface with this scheme/plugin. The workflow involves using cocli to submit reference values and ratsd to submit the evidence.

	return "", fmt.Errorf("measurement not found")
	return "", errors.New("measurement not found")

Add SEVSNP plugin for Veraison server #333

Are you sure you want to change the base?

Add SEVSNP plugin for Veraison server #333

Uh oh!

Conversation

jraman567 commented Sep 3, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande commented Sep 30, 2025

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thomas-fossati Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande commented Sep 30, 2025

Uh oh!

thomas-fossati left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

thomas-fossati Oct 1, 2025 •

edited

Loading