@reclaimprotocol/attestor-core
Version:
<div> <div> <img src="https://raw.githubusercontent.com/reclaimprotocol/.github/main/assets/banners/Attestor-Core.png" /> </div> </div>
60 lines (59 loc) • 2.28 kB
TypeScript
/**
* SEV-SNP combined attestation verifier (replaces the dead Nitro path).
*
* Faithful TS port of reclaim-tee shared/snp_combined_{aws,verify}.go:
* a 1-byte cloud tag (0x01 GCP / 0x02 AWS) then a CBOR envelope carrying the
* cross-cloud app hash, the cloud-specific hardware evidence, and the
* presentable nonce list (the SEV-SNP analogue of a CS JWT eat_nonce).
*/
export declare const SEV_TAG_GCP = 1;
export declare const SEV_TAG_AWS = 2;
export declare const SNP_APP_PREFIX = "snp-app:";
export declare const SNP_BASE_PREFIX = "snp-base:";
export declare const APP_PCR = 8;
export declare const BASE_PCR = 11;
export interface SevSnpEnvelope {
app: Uint8Array;
tpm?: Uint8Array;
nitrotpm?: Uint8Array;
sev?: Uint8Array;
nonces?: string[];
}
export interface SevSnpResult {
teeType: 'tee_k' | 'tee_t';
ethAddress: string;
app: string;
base: string;
nonces: string[];
}
/** Splits the 1-byte cloud tag from the CBOR envelope. */
export declare function parseSevSnpEnvelope(att: Uint8Array): Promise<{
tag: number;
env: SevSnpEnvelope;
}>;
/**
* snpNonceCommitment: sha256 over, for each nonce, the 8-byte big-endian byte
* length followed by the utf-8 bytes. Binding this in report_data/user_data is
* what makes the carried nonces unforgeable.
*/
export declare function snpNonceCommitment(nonces: string[]): Buffer;
/**
* expectedPCR8: the value the loader produces by extending a pristine (all-zero)
* PCR 8 once with alg(appHash), i.e. alg(0^algSize || alg(appHash)). GCP uses the
* SHA-256 bank, AWS the SHA-384 bank.
*/
export declare function expectedPCR8(appHash: Uint8Array, alg: 'sha256' | 'sha384'): Buffer;
export declare function appBaseIdentity(appHash: Uint8Array, pcr11: Uint8Array): {
app: string;
base: string;
};
export declare function extractTeeKeyFromNonces(nonces: string[]): {
teeType: 'tee_k' | 'tee_t';
ethAddress: string;
};
/**
* Verifies a claim-path combined SEV-SNP attestation end to end and returns the
* tee type, eth signing key, app/base identities, and the presentable nonces.
* `now` defaults to the real clock; tests may pass a time in the leaf window.
*/
export declare function verifyCombinedSevSnp(att: Uint8Array, now?: Date): Promise<SevSnpResult>;