[RFC] Add an initial Open DICE profile implementation.

[setrofim]

Add an innitial implmentation of validaiton and evidence extraction of Open DICE profile certificate chains.

[setrofim]

NOTE: This depends on COSE_Key implemented by veraison/go-cose#146 and cannot be merged until that has been integated into main and the dependencies have been adjusted accordingly.

[SampoSovio]

Hi Sergei,

This looks good i have suggestion related to ExtractOpenDiceChainFromX509

You have following loop there:

for i, cert := range certs {
		var odCert OpenDiceX509CdiCert

		if err = odCert.PopulateFromX509Cert(cert); err != nil {
			return nil, fmt.Errorf(
				"cert at index %d does appear to match Open DICE profile: %w",
				i, err,
			)
		}
		if verify {
			if _, err = odCert.Verify(verifOpts); err != nil {
				return nil, fmt.Errorf(
					"failed to verify cert at index %d: %w",
					i, err,
				)
			}
			verifOpts.Intermediates.AddCert(&odCert.Certificate)
		}
		result = append(result, odCert.GetEntry())
	}
}

If i undestand this code properly you are validating beginning of chain again and again. I would suggest following optimization:

var leaf x509.Certificate
for i, cert := range certs {
	var odCert OpenDiceX509CdiCert

	if err = odCert.PopulateFromX509Cert(cert); err != nil {
		return nil, fmt.Errorf(
			"cert at index %d does appear to match Open DICE profile: %w",
			i, err,
		)
	}
	if verify {
		verifOpts.Intermediates.AddCert(&odCert.Certificate)
		if len(certs) > 0 && i == len(certs)-1 {
			leaf = odCert.Certificate
		}
	}
	result = append(result, odCert.GetEntry())
}
if verify {
	if _, err = leaf.Verify(verifOpts); err != nil {
		return nil, fmt.Errorf(
			"failed to verify cert: %w",
			err,
		)
	}
}

Following test passes: func Test_ExtractOpenDiceChainFromX509(t *testing.T)

If you change line 278 to be:

assert.EqualError(t, err, "failed to verify cert: x509: certificate signed by unknown authority")

[setrofim]

Hi Sampo,

You're absolutely right, this was re-verifying the chain at each "segment". I've implemented your suggestion with a minor tweak. Thank you!

[thomas-fossati]

👍