laurencelundblade/ctoken

Encodes and decodes CWT, EAT and similar format tokens. It supports COSE format signing and verification as well as the UCCS unsigned format.

ctoken's Issues

Help requested for compiling ctoken.

Hello,
I am trying to compile ctoken project. I did the changes in Makefile to point to my local versions (latest masters ) of mbedtls / t_cose /QCBOR. But unfortunately, I ended up at below compilation issues ...

cc -o ctoken_test main.o test/eat_test.o test/cwt_test.o test/psa_test.o test/run_tests.o test/eat_test_tokens.o libctoken.a ../QCBOR/build_dir/libqcbor.a ../t_cose/libt_cose.a ../mbedtls/build_dir/library/libmbedcrypto.a -lm
cc -I ../mbedtls/include/ -I ../QCBOR/inc -I ../t_cose/inc -I inc -I test -I src -Os -fPIC -c -o examples/eat_example_psa.o examples/eat_example_psa.c
In file included from ../mbedtls/include/psa/crypto.h:68,
from examples/eat_example_psa.c:35:
examples/eat_example_psa.c: In function ‘make_psa_ecdsa_key_pair’:
examples/eat_example_psa.c:120:57: error: ‘PSA_ECC_CURVE_SECP256R1’ undeclared (first use in this function)
120 | key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP256R1);
| ^~~~~~~~~~~~~~~~~~~~~~~
../mbedtls/include/psa/crypto_values.h:524:40: note: in definition of macro ‘PSA_KEY_TYPE_ECC_KEY_PAIR’
524 | (PSA_KEY_TYPE_ECC_KEY_PAIR_BASE | (curve))
| ^~~~~
examples/eat_example_psa.c:120:57: note: each undeclared identifier is reported only once for each function it appears in
120 | key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP256R1);
| ^~~~~~~~~~~~~~~~~~~~~~~
../mbedtls/include/psa/crypto_values.h:524:40: note: in definition of macro ‘PSA_KEY_TYPE_ECC_KEY_PAIR’
524 | (PSA_KEY_TYPE_ECC_KEY_PAIR_BASE | (curve))
| ^~~~~
examples/eat_example_psa.c:127:57: error: ‘PSA_ECC_CURVE_SECP384R1’ undeclared (first use in this function)
127 | key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP384R1);
| ^~~~~~~~~~~~~~~~~~~~~~~
../mbedtls/include/psa/crypto_values.h:524:40: note: in definition of macro ‘PSA_KEY_TYPE_ECC_KEY_PAIR’
524 | (PSA_KEY_TYPE_ECC_KEY_PAIR_BASE | (curve))
| ^~~~~
examples/eat_example_psa.c:134:57: error: ‘PSA_ECC_CURVE_SECP521R1’ undeclared (first use in this function)
134 | key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_CURVE_SECP521R1);
| ^~~~~~~~~~~~~~~~~~~~~~~
../mbedtls/include/psa/crypto_values.h:524:40: note: in definition of macro ‘PSA_KEY_TYPE_ECC_KEY_PAIR’
524 | (PSA_KEY_TYPE_ECC_KEY_PAIR_BASE | (curve))
| ^~~~~
make: *** [: examples/eat_example_psa.o] Error 1

I understand as curves for certain macros has been deprecated from here (https://armmbed.github.io/mbed-crypto/html/appendix/history.html). Has any one faced this problem , if so any light on how to sail through would be appreciated..

Thanks,
Vijay

Deal with multiple labels for standard claims

Resolve what to do the ARM PSA profile claim

Support EAT HW Version

Complete the testing of all the basic type claims

There is little to fear that they have bugs because they are testing in QCBOR and are used by other claims that are tested, but the test should be created for completeness

Add support for swevidence claim

Perhaps this includes support for CoSWID and SUIT manifest, perhaps a some plug-in mechanism

remove just about all mention of attest_token

Implement encoding of the SW components claim

Do some interop test with other CWT and JWT implementations

make install

Allow disabling of submod decoding to save object code

Audience claim can be an array, but is not implemented so

EAT and intel SGX attestation

Hi,
I'm implementing remote attestation, I was wondering if there is any way of mapping of Intel SGX attestation quote to EAT token available?

revamp decode error reporting

Make it more like spiffy decode with internal error tracking

Add support for SUEID claim

Support COSE format public keys

This probably requires support for COSE_Key in t_cose first. t_cose is the right place to put a lot of this because it has the adaptation layer for crypto libraries.

This would also include the CWT conf claim.

Add support for manifests claim

Perhaps this includes CoSWID

EAT example fails..

cotken passes all the tests..

[bwalker@localhost ctoken]$ ./ctoken_test
sizeof(ctoken_decode_context) 432
sizeof(ctoken_encode_ctx) 312
...
cwt_tags_test PASSED
get_next_test PASSED
SUMMARY: 18 tests run; 0 tests failed
[bwalker@localhost ctoken]$

But, the EAT test seems to fail.. Any idea why or where I should look to try and debug this?

[bwalker@localhost ctoken]$ ./eat_example_ossl
Made EC key with curve prime256v1: 0 (success)
Finished making EAT: 2 (fail)
[bwalker@localhost ctoken]$

Resolve what to do with ARM PSA HW Version

Move header files into a ctoken directory

Method to iterate over all claims in a token

error codes needs a general clean up

Add support for EAT claims required by TEEP

From https://datatracker.ietf.org/doc/html/draft-ietf-teep-protocol#section-4.3.1 :

   +------------+---------------------+--------------------------------+
   | Requiremen | Claim               | Reference                      |
   | t          |                     |                                |
   +------------+---------------------+--------------------------------+
   | Device     | device-identifier   | [I-D.birkholz-rats-suit-claims |
   | unique     |                     | ] section 3.1.3                |
   | identifier |                     |                                |
   | Vendor of  | vendor-identifier   | [I-D.birkholz-rats-suit-claims |
   | the device |                     | ] section 3.1.1                |
   | Class of   | class-identifier    | [I-D.birkholz-rats-suit-claims |
   | the device |                     | ] section 3.1.2                |
   | TEE        | chip-version-scheme | [I-D.ietf-rats-eat] section    |
   | hardware   |                     | 3.7                            |
   | type       |                     |                                |
   | TEE        | chip-version-scheme | [I-D.ietf-rats-eat] section    |
   | hardware   |                     | 3.7                            |
   | version    |                     |                                |
   | TEE        | component-          | [I-D.birkholz-rats-suit-claims |
   | firmware   | identifier          | ] section 3.1.4                |
   | type       |                     |                                |
   | TEE        | version             | [I-D.birkholz-rats-suit-claims |
   | firmware   |                     | ] section 3.1.8                |
   | version    |                     |                                |
   | Freshness  | nonce               | [I-D.ietf-rats-eat] section    |
   | proof      |                     | 3.3                            |
   +------------+---------------------+--------------------------------+

Currently only nonce is listed as supported in the ctoken readme file.

Encoding of PSA SW Components claim

Decoding is supported, but encoding is not.

Note that the TFM version of this SW constructs the SW Component claims in its own way. What is done here is needed for the general library and for xclaim. Maybe they can be combined, maybe not.

All decoding of claims without signature verification (needed for PSA)

This is to allow fetching claims that identify the verification key.