Struct graphene_sgx::AttestationVerifier

pub struct AttestationVerifier { /* fields omitted */ }

Attestation verifier enables easy checking of various attestation evidence properties.

Example

 use chrono::Duration;
 use graphene_sgx::sgx::SgxQuote;
 use graphene_sgx::AttestationResponse;

 let quote = SgxQuote::hasher()
     .data(&[0u8; 42])
     .data(&[1u8; 10])
     .build()
     .unwrap();
 let evidence = AttestationResponse::default(); // this should be obtained from IAS
 let verifier = evidence.verifier();
 let result = verifier.max_age(Duration::minutes(1))
     .data(&[0u8; 42])
     .data(&[1u8; 10])
     .mr_enclave(quote.body.report_body.mr_enclave)
     .isv_prod_id(42)
     .not_debug()
     .check();

Implementations

impl AttestationVerifier

pub fn data(self, data: &[u8]) -> Self

Add custom data to hash. All bytes added using this method are hashed with SHA512 and compared with enclave quote's report_data field.

pub fn nonce(self, nonce: &str) -> Self

Check IAS report's nonce.

pub fn mr_enclave(self, mr: SgxMeasurement) -> Self

Check enclave's hash (must match the supplied value).

pub fn mr_enclave_list(self, mrs: &[SgxMeasurement]) -> Self

Check enclave's hash (must match any of the supplied values).

pub fn mr_signer(self, mr: SgxMeasurement) -> Self

Check enclave's hash of signing key (must match the supplied value).

pub fn mr_signer_list(self, mrs: &[SgxMeasurement]) -> Self

Check enclave's hash of signing key (must match any of the supplied values).

pub fn isv_prod_id(self, id: u16) -> Self

Check enclave's ISV product ID.

pub fn isv_svn(self, svn: u16) -> Self

Check enclave's security version number.

pub fn not_outdated(self) -> Self

Check that enclave's IAS status is not GROUP_OUT_OF_DATE (platform missing security updates).

pub fn not_debug(self) -> Self

Check that enclave is not in debug mode.

pub fn max_age(self, age: Duration) -> Self

Check maximum age of the IAS report (using report's timestamp).

pub fn check(self) -> AttestationResult

Finalize all checks and convert the verifier into attestation result.