attest: Allow verification of quote without a corresponding event log about go-attestation HOT 5 CLOSED

To provide some more context based on an offline conversation:

The reason why you want to do this (quote /w a nonce & not correlate it to an event log / PCRs) is it enables you to demonstrate you have control of a specific AIK. We cannot just sign some data using the AIK as AIKs cannot sign arbitrary data.

Extending this further, if you choose the nonce carefully, say by hashing together (with a safe scheme) a serverside nonce + some other data, it allows you to prove you are in possession of an AIK and the system corresponding to the AIK is notarizing the other data.

An example of when you would use this is to certify a non TPM-resident (system/disk resident) key. You would combine a serverside nonce + the hash of the public key into a single value, then use that single value as the nonce to Quote(). On the server, you can verify that the quote signs the correct nonce + the hash of the public key.

from go-attestation.

Okay, I think we should refactor the EventLog API. I like the Parse/Verify pattern, and having more focused structs would be good:

// EventLog is a parsed measurement log. This contains unverified data representing
// boot events that must be replayed against PCR values to determine authenticity.
type EventLog struct {
    // no exported fields
}

// ParseEventLog parses an unverified measurement log.
func ParseEventLog(measurementLog []byte) (*EventLog, error) {
}

// Verify replays the event log against a TPM's PCR values.
func (e *EventLog) Verify(pcrs []PCR) ([]Event, error) {
}

// Verify is used to prove authenticity of the PCR measurements. It ensures that
// the quote was signed by the AIK, and that its contents matches the PCR and
// nonce combination.
//
// The nonce is used to prevent replays of Quote and PCRs and is signed by the
// quote. Some TPMs don't support nonces longer than 20 bytes, and if the
// nonce is used to tie additional data to the quote, the additional data should be
// hashed to construct the nonce.
func (a *AIKPublic) Verify(quote Quote, pcrs []PCR, nonce []byte) error {
}

edit: added doc comments

from go-attestation.

LGTM. Should I implement or would you prefer to take this?

from go-attestation.

Feel free to take it. If not, I can. :)

from go-attestation.

Closed by #87

from go-attestation.