rialo_types/
tee_types.rs

1// Copyright (c) Subzero Labs, Inc.
2// SPDX-License-Identifier: Apache-2.0
3
4//! Core TEE types used in REX attestation
5
6use borsh::{BorshDeserialize, BorshSerialize};
7pub use rialo_tee_types::TeeType;
8use serde::{Deserialize, Serialize};
9
10// Re-export crypto types for backward compatibility
11pub use crate::crypto::{PublicKey, TeeUserData, TEE_USER_DATA_SIZE, X25519_KEY_SIZE};
12
13/// TEE platform attestation evidence
14#[derive(
15    Clone, Default, Eq, PartialEq, Serialize, Deserialize, BorshSerialize, BorshDeserialize,
16)]
17pub struct AttestationEvidence {
18    pub tee_type: TeeType,
19    pub evidence_data: Vec<u8>,
20}
21
22impl std::fmt::Debug for AttestationEvidence {
23    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
24        let truncated_data = if self.evidence_data.len() <= 16 {
25            format!("{:?}", self.evidence_data)
26        } else {
27            format!(
28                "{:?}... (truncated, total: {} bytes)",
29                &self.evidence_data[..16],
30                self.evidence_data.len()
31            )
32        };
33
34        f.debug_struct("AttestationEvidence")
35            .field("tee_type", &self.tee_type)
36            .field("evidence_data", &truncated_data)
37            .finish()
38    }
39}
40
41/// SEV-SNP specific evidence data structure
42///
43/// This structure contains the raw SEV-SNP attestation data that gets
44/// serialized/deserialized from the `evidence_data` field of `AttestationEvidence`.
45#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
46pub struct SevSnpEvidenceData {
47    /// The raw SEV-SNP attestation report
48    pub report: Vec<u8>,
49    /// the VLEK or VCEK certificate
50    pub vek_certificate: Vec<u8>,
51}
52
53/// Azure SEV-SNP specific evidence data structure
54///
55/// This structure contains the raw SEV-SNP attestation data that gets
56/// serialized/deserialized from the `evidence_data` field of `AttestationEvidence`.
57#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
58pub struct AzureSevSnpEvidenceData {
59    /// SEV-SNP attestation report containing user_data
60    pub snp_evidence: SevSnpEvidenceData,
61}
62
63/// AWS Nitro TPM COSE Evidence structure used for attestation verification
64///
65/// This structure contains the AWS Nitro TPM attestation data in COSE format along with
66/// supporting metadata required for verification. The COSE report includes TPM-based
67/// measurements and signatures that prove the identity and state of the AWS Nitro enclave.
68#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
69pub struct AwsNitroCoseEvidence {
70    /// AWS COSE signed report containing TPM attestation data
71    ///
72    /// This report includes Platform Configuration Registers (PCRs)
73    /// and digital signatures required to verify the authenticity and integrity of
74    /// the enclave.
75    pub report: Vec<u8>,
76    /// Cryptographic nonce value used to prevent replay attacks
77    ///
78    /// This nonce is included in the attestation request and must match
79    /// the value embedded in the COSE report to ensure freshness.
80    pub nonce: Vec<u8>,
81    /// Unix timestamp (in seconds) when the COSE report was generated
82    ///
83    /// Used to verify the attestation report's recency and detect
84    /// potential replay attacks.
85    pub time: u64,
86}
87
88/// AWS SEV-SNP specific evidence data structure optimized for AWS Nitro
89///
90/// This simplified structure leverages AWS Nitro's built-in attestation capabilities
91/// and prepares for future AWS COSE signed reports that will include all TPM data.
92/// The user_data contains the REX digest (32 bytes) that gets embedded in both
93/// the SEV-SNP report and the AWS COSE report for binding.
94#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
95pub struct AwsSevSnpEvidenceData {
96    /// SEV-SNP attestation report containing user_data
97    pub snp_evidence: SevSnpEvidenceData,
98    /// AWS Nitro COSE attestation report
99    pub aws_nitro_cose_evidence: AwsNitroCoseEvidence,
100}
101
102/// Error type for TEE evidence parsing
103#[derive(Debug, thiserror::Error)]
104pub enum TeeEvidenceError {
105    #[error("Invalid evidence: {0}")]
106    InvalidEvidence(String),
107}
108
109impl TryFrom<&AttestationEvidence> for SevSnpEvidenceData {
110    type Error = TeeEvidenceError;
111    fn try_from(evidence: &AttestationEvidence) -> Result<Self, Self::Error> {
112        parse_evidence(evidence, &[TeeType::SevSnp])
113    }
114}
115
116impl TryFrom<&AttestationEvidence> for AwsSevSnpEvidenceData {
117    type Error = TeeEvidenceError;
118    fn try_from(evidence: &AttestationEvidence) -> Result<Self, Self::Error> {
119        parse_evidence(evidence, &[TeeType::AwsSevSnp])
120    }
121}
122
123impl TryFrom<&AttestationEvidence> for AzureSevSnpEvidenceData {
124    type Error = TeeEvidenceError;
125    fn try_from(evidence: &AttestationEvidence) -> Result<Self, Self::Error> {
126        parse_evidence(evidence, &[TeeType::AzureSevSnp])
127    }
128}
129
130/// Generic evidence parsing function that validates TEE type and deserializes evidence data
131///
132/// This function provides a unified way to parse evidence data across different TEE types,
133/// validating that the evidence matches one of the expected TEE types before attempting
134/// to deserialize the data into the target type.
135pub fn parse_evidence<T>(
136    evidence: &AttestationEvidence,
137    expected_tee_types: &[TeeType],
138) -> Result<T, TeeEvidenceError>
139where
140    T: for<'de> Deserialize<'de>,
141{
142    // Validate TEE type
143    if !expected_tee_types.contains(&evidence.tee_type) {
144        return Err(TeeEvidenceError::InvalidEvidence(format!(
145            "Expected TEE types {:?}, got {:?}",
146            expected_tee_types, evidence.tee_type
147        )));
148    }
149
150    // Parse evidence data
151    serde_json::from_slice(&evidence.evidence_data)
152        .map_err(|e| TeeEvidenceError::InvalidEvidence(format!("Failed to parse evidence: {e}")))
153}
rialo_types/tee_types.rs

rialo_types/
tee_types.rs
