dcap_qvl/
constants.rs

1#![allow(dead_code)]
2
3/// MR_SIGNER measurement (32 bytes)
4pub type MrSigner = [u8; 32];
5/// MR_ENCLAVE measurement (32 bytes)
6pub type MrEnclave = [u8; 32];
7/// FMSPC - Firmware Security Version & Package Configuration (6 bytes)
8pub type Fmspc = [u8; 6];
9/// CPU SVN - Security Version Number for CPU microcode (16 bytes)
10pub type CpuSvn = [u8; 16];
11/// SVN - Security Version Number (16-bit)
12pub type Svn = u16;
13
14pub const ATTESTATION_KEY_TYPE_ECDSA256_WITH_P256_CURVE: u16 = 2;
15pub const ATTESTATION_KEY_TYPE_ECDSA484_WITH_P384_CURVE: u16 = 3;
16
17pub const TEE_TYPE_SGX: u32 = 0x00000000;
18pub const TEE_TYPE_TDX: u32 = 0x00000081;
19
20pub const ECDSA_256_WITH_P256_CURVE: u16 = 2;
21pub const ECDSA_384_WITH_P384_CURVE: u16 = 3;
22pub const ECDSA_P256_SIGNATURE_BYTE_LEN: usize = 64;
23pub const BODY_BYTE_SIZE: usize = 6;
24pub const BODY_SGX_ENCLAVE_REPORT_TYPE: u16 = 1;
25pub const BODY_TD_REPORT10_TYPE: u16 = 2;
26pub const BODY_TD_REPORT15_TYPE: u16 = 3;
27pub const ENCLAVE_REPORT_BYTE_LEN: usize = 384;
28pub const TD_REPORT10_BYTE_LEN: usize = 584;
29pub const TD_REPORT15_BYTE_LEN: usize = 648;
30
31pub const PCK_ID_PLAIN_PPID: u16 = 1;
32pub const PCK_ID_ENCRYPTED_PPID_2048: u16 = 2;
33pub const PCK_ID_ENCRYPTED_PPID_3072: u16 = 3;
34pub const PCK_ID_PCK_CERTIFICATE: u16 = 4;
35pub const PCK_ID_PCK_CERT_CHAIN: u16 = 5;
36pub const PCK_ID_QE_REPORT_CERTIFICATION_DATA: u16 = 6;
37
38pub const ALLOWED_QUOTE_VERSIONS: [u16; 3] = [3, 4, 5];
39pub const ALLOWED_BODY_TYPES: [u16; 3] = [
40    BODY_SGX_ENCLAVE_REPORT_TYPE,
41    BODY_TD_REPORT10_TYPE,
42    BODY_TD_REPORT15_TYPE,
43];
44pub const ALLOWED_TEE_TYPES: [u32; 2] = [TEE_TYPE_SGX, TEE_TYPE_TDX];
45pub const ALLOWED_ATTESTATION_KEY_TYPES: [u16; 1] = [ECDSA_256_WITH_P256_CURVE];
46pub const INTEL_QE_VENDOR_ID: [u8; 16] = [
47    0x93, 0x9A, 0x72, 0x33, 0xF7, 0x9C, 0x4C, 0xA9, 0x94, 0x0A, 0x0D, 0xB3, 0x95, 0x7F, 0x06, 0x07,
48];
49pub const HEADER_BYTE_LEN: usize = 48;
50pub const AUTH_DATA_SIZE_BYTE_LEN: usize = 4;
51
52pub const ECDSA_SIGNATURE_BYTE_LEN: usize = 64;
53pub const ECDSA_PUBKEY_BYTE_LEN: usize = 64;
54pub const QE_REPORT_BYTE_LEN: usize = ENCLAVE_REPORT_BYTE_LEN;
55pub const QE_REPORT_SIG_BYTE_LEN: usize = ECDSA_SIGNATURE_BYTE_LEN;
56pub const CERTIFICATION_DATA_TYPE_BYTE_LEN: usize = 2;
57pub const CERTIFICATION_DATA_SIZE_BYTE_LEN: usize = 4;
58pub const QE_AUTH_DATA_SIZE_BYTE_LEN: usize = 2;
59pub const QE_CERT_DATA_TYPE_BYTE_LEN: usize = 2;
60pub const QE_CERT_DATA_SIZE_BYTE_LEN: usize = 4;
61
62pub const AUTH_DATA_MIN_BYTE_LEN: usize = ECDSA_SIGNATURE_BYTE_LEN
63    + ECDSA_PUBKEY_BYTE_LEN
64    + QE_REPORT_BYTE_LEN
65    + QE_REPORT_SIG_BYTE_LEN
66    + QE_AUTH_DATA_SIZE_BYTE_LEN
67    + QE_CERT_DATA_TYPE_BYTE_LEN
68    + QE_CERT_DATA_SIZE_BYTE_LEN;
69
70pub const QUOTE_MIN_BYTE_LEN: usize =
71    // Actual minimal size is a Quote V3 with Enclave report
72    HEADER_BYTE_LEN
73        + ENCLAVE_REPORT_BYTE_LEN
74        + AUTH_DATA_SIZE_BYTE_LEN
75        + AUTH_DATA_MIN_BYTE_LEN;
76
77pub const ATTESTATION_KEY_LEN: usize = 64;
78pub const AUTHENTICATION_DATA_LEN: usize = 32;
79pub const QE_HASH_DATA_BYTE_LEN: usize = ATTESTATION_KEY_LEN + AUTHENTICATION_DATA_LEN;
80
81pub const PCK_ID_PLAIN: u16 = 1;
82pub const PCK_ID_RSA_2048_OAEP: u16 = 2;
83pub const PCK_ID_RSA_3072_OAEP: u16 = 3;
84pub const PCK_LEAF_CERT_PLAIN: u16 = 4;
85pub const PCK_CERT_CHAIN: u16 = 5;
86pub const QE_REPORT_CERT: u16 = 6;
87pub const PLATFORM_MANIFEST: u16 = 7;
88
89// PCK certificate issuer identifiers (lowercase strings used in PCS URLs
90// and FFI bindings; rendered from `crate::config::PckCa::as_id_str`).
91pub const PROCESSOR_ISSUER_ID: &str = "processor";
92pub const PLATFORM_ISSUER_ID: &str = "platform";
93
94// Substrings matched against the issuer DN to classify a PCK leaf as
95// Processor- or Platform-issued. Crate-private; see
96// `X509CertParsed::pck_ca`.
97pub(crate) const PROCESSOR_ISSUER: &str = "Processor";
98pub(crate) const PLATFORM_ISSUER: &str = "Platform";
99
100// The root cert is downloaded from `https://certificates.trustedservices.intel.com/Intel_SGX_Provisioning_Certification_RootCA.cer`.
101// See https://api.portal.trustedservices.intel.com/content/documentation.html#pcs for more details
102pub static TRUSTED_ROOT_CA_DER: &[u8] = include_bytes!("TrustedRootCA.der");
103
104#[cfg(test)]
105#[tokio::test]
106async fn dcap_roots_should_be_fresh() {
107    #[allow(clippy::unwrap_used)]
108    let response = reqwest::get(
109        "https://certificates.trustedservices.intel.com/Intel_SGX_Provisioning_Certification_RootCA.cer",
110    )
111    .await
112    .unwrap();
113
114    #[allow(clippy::unwrap_used)]
115    let ca_der = response.bytes().await.unwrap();
116
117    assert_eq!(TRUSTED_ROOT_CA_DER, ca_der.as_ref());
118}
dcap_qvl/constants.rs

dcap_qvl/
constants.rs
