Crate underhill_attestation 

This modules implements attestation protocols for Underhill to support TVM and CVM, including getting a tenant key via secure key release (SKR) for unlocking VMGS and requesting an attestation key (AK) certificate for TPM. The module also implements the VMGS unlocking process based on SKR.

Modules

runtime_sealing

Local hardware protector verification and recreation for runtime recovery.

Structs

Error

An attestation error.

HostAttestationSettings

Host attestation settings obtained via the GET GSP call-out.

IgvmAttestRequestHelper

Helper struct to create IgvmAttestRequest in raw bytes.

PlatformAttestationData

The return values of initialize_platform_security.

Enums

AkCertResponse

The certificate or renewal decision returned by the host.

AttestationType

The attestation type to use.

IgvmAttestError

Functions

derive_vmgsid

Derive the expected VMGSID from the encrypted seed data.

get_provenance_claims

Read the VMGS provenance doc and produce runtime claims

initialize_platform_security

If required, attest platform. Gets VMGS datastore key.

parse_ak_cert_metadata

Extract renewal hints, not a certificate trust decision.

parse_ak_cert_response

Parse an AK_CERT_REQUEST response, including V2 renewal decisions.