feat: receive Intel & AMD CRLs in attestation report

[rjzak]

Depends on:

• feat: sgx backend sends CRL for attestation enarx#2393
• feat: snp backend sends CRL for attestation enarx#2428

Refs:

• Missing SGX attestation steps #112

Blocking:

• feat: cache & send Intel TCB report during attestation enarx#2434

Edit: CRL validation disabled for now to permit new deployments of Enarx, Steward, Drawbridge. Enabling of CRL validation will be a subsequent PR.

Signed-off-by: Richard Zak [email protected]

[rjzak]

@puiterwijk please double-check the loop, as I noticed that some intermediate certs are failing the CRL signature check. The logic:

1. Get the URLs from the TbsCertificate, can be more than one.
2. Identify the CertificateList objects to use based on the found URLs, or bail! if no CRLs are found.
3. Get the raw bytes of the CRL by converting the CertificateList.tbs_cert_list back to DER
4. Use the Certificate's public key to check the DER bytes above with the signature in the CRL.

Example of when it succeeds:

CRL validation success!
        Cert algo: 1.2.840.113549.1.1.10
        Cert subject: OU=Engineering,C=US,L=Santa Clara,STATEORPROVINCENAME=CA,O=Advanced Micro Devices,CN=ARK-Milan
        CRL issuer: OU=Engineering,C=US,L=Santa Clara,STATEORPROVINCENAME=CA,O=Advanced Micro Devices,CN=ARK-Milan
        CRL algo: 1.2.840.113549.1.1.10
        URL: ["https://kdsintf.amd.com/vcek/v1/Milan/crl"]

Example when it fails:

CRL validation error: signature error: verification error
        Cert algo: 1.2.840.113549.1.1.10
        Cert subject: OU=Engineering,C=US,L=Santa Clara,STATEORPROVINCENAME=CA,O=Advanced Micro Devices,CN=SEV-Milan
        CRL issuer: OU=Engineering,C=US,L=Santa Clara,STATEORPROVINCENAME=CA,O=Advanced Micro Devices,CN=ARK-Milan
        CRL algo: 1.2.840.113549.1.1.10
        URL: ["https://kdsintf.amd.com/vcek/v1/Milan/crl"]

The issuer is different in the failure case, but the cert had the same CRL URL.

[rjzak]

Seems that I have an issue where the wrong CRL is used to validate intermediate certs. I've made a tool to help me debug what's going on: https://github.com/rjzak/cert-buddy. So far, the CRL format on-disk is fine.

[rjzak]

Progress: CRLs are now passing for Intel. AMD isn't working as the root CRL is used for intermediate & end certificates, so a different CRL selection strategy is needed.