Add support for CMW evidence format - server side #1777
Conversation
Signed-off-by: HarshvMahawar <[email protected]>
| return base64.urlsafe_b64decode(padded) | ||
|
|
||
|
|
||
| def read_tlv(stream: BytesIO): |
| tag, _, _ = read_tlv(stream) | ||
| if tag is None: | ||
| break | ||
| if tag != 0: |
There was a problem hiding this comment.
Use constants and refrence the spec what they mean. Makes it more readable
| } | ||
|
|
||
|
|
||
| def fetch_and_decode_cmw(url: str, cert: str, key: str, verify_ssl: bool = False) -> Dict[str, Any]: |
There was a problem hiding this comment.
For what is this function needed?
There was a problem hiding this comment.
I used this for manual decoding of CMW over API, it returns the decoded CMW to convectional KeylimeQuote object
will add docstrings
| else: | ||
| try: | ||
| json_response = json.loads(response.body) | ||
| if agent['supported_version'] == '2.4': |
There was a problem hiding this comment.
We can leave this for now but will need to put a proposal in to update it likely to something different
idk why there are linting errors, tox didn't gave any errors in local run, I will look into the errors again |
|
Please document the changes to the protocol messages. You can check how the PR #1753 updated the documentation and add there the changes related with these messages. |
|
With the withdrawal of the proposal keylime/enhancements#126, the interest on standardized formats increase. Please consider rebasing this, and if possible, also make it work on the It would be nice if backwards compatibility is kept, and that the Later, when the push attestation PR is also merged, it would be nice to extend it to also accept the |
Add Conceptual Message Wrapper (CMW) evidence support
Type of Change
(Select all that apply)
Change Description
Concise Summary
Support CMW-based evidence collection instead of custom quote parsing
This PR adds initial support for receiving attestation evidence encoded using the Conceptual Message Wrapper (CMW), as prescribed by the IETF draft. It introduces decoding logic and replaces custom measurement list parsing when CMW is negotiated.
Technical Details
Added
decode_cmw.pyto handle CMW decoding and extract:Updated integrity quote handler to recognize CMW-formatted responses
Preserves compatibility with existing attestation flows:
Motivation:
No breaking changes expected; clients not using CMW remain unaffected
Documentation Updates Required
(Check all that apply)
docs/cmw.md)docs/)Verification Process
Environment:
Procedure:
Expected vs actual results:
Checklist
Additional Context