fix(tdx): parse the nested QE certification data; validate on real hardware - #61
Merged
Merged
Conversation
Removes ca2a's last duplicated attestation crypto. ca2a_verify.verify_cert_chain (shared by the SEV-SNP VCEK, TDX PCK, and TPM AK chains) now delegates to agent_manifest.verify_cert_chain, the org's shared generic algorithm-agnostic verifier, re-raising CertChainError as AttestationFailed to preserve ca2a's contract. ca2a keeps its own parsers, per-format signature checks, appraisal shapes, trust-root pinning, and verify_offer semantics. Dep: adds agent-manifest>=0.5. 201 tests pass unchanged; ruff + mypy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rdware TdxQuote.parse threw on every genuine DCAP v4 quote. Real quotes nest the Quoting Enclave material: the bytes after the attestation key are a certification-data header of type 6 (QE_REPORT_CERTIFICATION_DATA) wrapping the QE report, its PCK signature, the auth data and the type-5 PCK chain. The parser read the QE report directly after the attestation key, six bytes early, so a real GCP C3 quote failed with a bogus cert-length read. The synthetic fixture emitted the same flat layout, so the tests validated the defect. Failure was closed, so this is a false negative rather than an unsound accept, but the TDX path had never worked against real evidence. Both verifiers now run against genuine hardware evidence, env-gated because the captures embed per-CPU identifiers: a real Azure CVM SEV-SNP report (CA2A_SNP_FIXTURE_DIR) and a real GCP C3 TDX quote (CA2A_TDX_QUOTE), each also asserted to fail closed on a tampered copy. docs/hardware-validation.md records what is now verified and, as importantly, what still is not: this validates the verifier, not a running attested peer. The live handshake is still software mode, so cA2A is still not attested across trust domains, and LIMITATIONS and ROADMAP say so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
TdxQuote.parsethrew on every genuine DCAP v4 quote.Real quotes nest the Quoting Enclave material: the bytes after the attestation key are a certification-data header of type 6 (
QE_REPORT_CERTIFICATION_DATA) wrapping the QE report, its PCK signature, the auth data and the type-5 PCK chain. The parser read the QE report directly after the attestation key, six bytes early, so a real GCP C3 quote failed on a bogus cert-length read.The synthetic fixture emitted the same flat layout, so the tests validated the defect. Failure was closed, so this is a false negative rather than an unsound accept, but the TDX path had never worked against real evidence. The same defect is fixed in cmcp (agentrust-io/cmcp#420);
agent-manifest, whose parser was written against this exact capture, was already correct.Now validated against real hardware evidence
Env-gated (
CA2A_SNP_FIXTURE_DIR,CA2A_TDX_QUOTE) because the captures embed per-CPU identifiers and cannot be committed.What this does not claim
docs/hardware-validation.mdis as explicit about the gap as about the win: this validates the verifier against real evidence, not a running attested peer. The live handshake still runs in software mode atassurance="none", so cA2A is still not attested across trust domains, and that stays on the ROADMAP critical path. TPM remains synthetic-only.Test plan
pytest tests/unit/test_tdx.pywithCA2A_TDX_QUOTE— 11 passedpytest tests/unit/test_sev_snp.pywithCA2A_SNP_FIXTURE_DIR— 11 passedpytest tests/— 198 passed, 6 pre-existingtest_cedar.pyfailures unrelated to this change (they fail identically on a clean tree; local cedar binding issue)🤖 Generated with Claude Code