Pin enclave measurement (MRTD/TCB) — attestation that proves our code [L1]#269
Merged
Conversation
…rce) Attestation proved "a genuine TDX VM bound to this key" but never checked the measurement, so any genuine enclave (incl. different/malicious code) with a valid token + bound key passed. mrtd was logged and never compared. Add ita::ExpectedMeasurements (mrtd allowlist + tcb_status + enforce flag) from env (DD_EXPECTED_MRTD / DD_EXPECTED_TCB / DD_MEASUREMENT_ENFORCE). Check after verifier.verify in cp.rs::register and the collector scrape: unset = observe-only (current behavior), pinned+enforce = reject mismatch (401 / drop from store), pinned+!enforce = warn (canary). Default tcb = UpToDate once pinned. Source of the pinned value is a committed/blessed measurement (PR review = trust anchor), or the ee-mini signed manifest once it exists. Note: this pins the firmware+kernel+initrd baseline; covering the rootfs needs dm-verity (ee-mini, Layer 0) and workloads need digest pinning (Layer 2). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
DD preview readyURL: https://pr-269.devopsdefender.com Browser login: visit https://pr-269.devopsdefender.com — DD redirects you to Machine-to-machine: GitHub Actions workflows in the Register endpoint for a local agent: |
Mirror the client fix: Intel TDX tokens expose the quote report_data as tdx_report_data, not attester_held_data. Harmless today (CP reads only mrtd/tcb) but keeps Claims correct as measurement/binding checks expand.
Intel tokens use tdx_report_data; the local dev issuer (mint_local) uses attester_held_data. Read tdx_report_data first, attester_held_data as the local-mode source. (Reverts the over-eager removal that broke local-mode tests.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Attestation today proves "a genuine, TCB-up-to-date TDX VM bound to this Noise key" but never checks which code runs —
mrtdwas logged (cp.rs:512) and never compared. So any genuine TDX enclave (incl. different/malicious code) with a valid token + bound key passes. (confer-proxy had the same gap.)What (Layer 1 — warn-then-enforce)
ita::ExpectedMeasurements(MRTD allowlist +tcb_status+enforce) from env:DD_EXPECTED_MRTD(comma/space-sep hex; unset = observe-only)DD_EXPECTED_TCB(defaultUpToDateonce pinned)DD_MEASUREMENT_ENFORCE=0→ warn instead of reject (canary)Checked after
verifier.verifyincp.rs::register(reject → 401) and the collector scrape (drop from store). The blessed MRTD is sourced from a committed pin (PR review = trust anchor) or, later, the ee-mini signed manifest.Client-side counterpart: devopsdefender/dd-client#4 (
--expected-mrtd).Scope / honesty
This pins the firmware + kernel + initrd baseline. It does not yet cover:
ext4-labelwith no dm-verity, so the rootfs is unmeasured/mutable (Layer 0, ee-mini: enable dm-verity → roothash in cmdline → RTMR);devopsdefender/cloudflaredare fetched at boot, not measured (Layer 2: pin digests).Land this in warn mode (don't set
DD_EXPECTED_MRTD) for visibility; bless the captured MRTD in a follow-up, then enforce. Tests cover match/mismatch/bad-TCB/unpinned.🤖 Generated with Claude Code