Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated DefaultDeviceAttestationVerifier to Verify that PAA KeyId is in the CD. #18219

Merged
merged 1 commit into from
May 11, 2022
+19 −2
Merged

Updated DefaultDeviceAttestationVerifier to Verify that PAA KeyId is in the CD. #18219

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions src/credentials/attestation_verifier/DefaultDeviceAttestationVerifier.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,6 +278,12 @@ void DefaultDACVerifier::VerifyAttestationInformation(const DeviceAttestationVer
.paaVendorId = paaVidPid.mVendorId.ValueOr(VendorId::NotSpecified),
};

MutableByteSpan paaSKID(deviceInfo.paaSKID);
VerifyOrExit(ExtractSKIDFromX509Cert(paaDerBuffer, paaSKID) == CHIP_NO_ERROR,
attestationError = AttestationVerificationResult::kPaaFormatInvalid);
VerifyOrExit(paaSKID.size() == sizeof(deviceInfo.paaSKID),
attestationError = AttestationVerificationResult::kPaaFormatInvalid);

VerifyOrExit(DeconstructAttestationElements(info.attestationElementsBuffer, certificationDeclarationSpan,
attestationNonceSpan, timestampDeconstructed, firmwareInfoSpan,
vendorReserved) == CHIP_NO_ERROR,
Expand Down Expand Up @@ -384,6 +390,14 @@ AttestationVerificationResult DefaultDACVerifier::ValidateCertificateDeclaration
}
}

if (cdContent.authorizedPAAListPresent)
{
// The Subject Key Id of the PAA SHALL match one of the values present in the authorized_paa_list
// in the Certification Declaration.
VerifyOrReturnError(cdElementsDecoder.HasAuthorizedPAA(certDeclBuffer, ByteSpan(deviceInfo.paaSKID)),
AttestationVerificationResult::kCertificationDeclarationInvalidPAA);
}

return AttestationVerificationResult::kSuccess;
}

Expand Down
7 changes: 5 additions & 2 deletions src/credentials/attestation_verifier/DeviceAttestationVerifier.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ enum class AttestationVerificationResult : uint16_t
kCertificationDeclarationInvalidFormat = 603,
kCertificationDeclarationInvalidVendorId = 604,
kCertificationDeclarationInvalidProductId = 605,
kCertificationDeclarationInvalidPAA = 606,

kNoMemory = 700,

Expand All @@ -93,16 +94,18 @@ struct DeviceInfoForAttestation
uint16_t vendorId = VendorId::NotSpecified;
// Product ID reported by device in Basic Information cluster
uint16_t productId = 0;
// Vendor ID from DAC
// Vendor ID from DAC
uint16_t dacVendorId = VendorId::NotSpecified;
// Product ID from DAC
uint16_t dacProductId = 0;
// Vendor ID from PAI cert
uint16_t paiVendorId = VendorId::NotSpecified;
// Product ID from PAI cert (0 if absent)
uint16_t paiProductId = 0;
// Vendor ID from PAA cert
// Vendor ID from PAA cert
uint16_t paaVendorId = VendorId::NotSpecified;
// Subject Key Identifier (SKID) from PAA cert
uint8_t paaSKID[Crypto::kSubjectKeyIdentifierLength] = { 0 };
};

typedef void (*OnAttestationInformationVerification)(void * context, AttestationVerificationResult result);
Expand Down