attest: Implement EK cert verification, remove verifier/ subpackage about go-attestation HOT 5 CLOSED

// EKCertVerifier checks that EK certificates chain up to a set of intermediates
// and root certificates.
type EKCertVerifier struct {
  roots, intermediates *x509.CertPool
}

// NewEKCertVerifier builds an EKCertVerifier object from the given set
// of root & intermediate certificates.
func NewEKCertVerifier(roots, intermediates []byte) (*EKCertVerifier, error) {
  // parse certs --> respective cert pools
}

// Verify checks the EK cert chains up to a known set of root & intermediate
// certificates.
func (v *EKCertVerifier) Verify(cert []byte) (chains [][]*x509.Certificate, err error) {
  // ...
}

@ericchiang WDYT?

from go-attestation.

This functionality is already available via "crypto/x509".Certificate.Verify https://golang.org/pkg/crypto/x509/#Certificate.Verify

I don't see the benefit of adding duplicate API here. Would this be better as documentation?

from go-attestation.

We could get away with documentation if we specify:

• Youre gonna need to use the cert-transparency x509 package
• Set cert.UnhandledCriticalExtensions to nil in the EKCert before verifying
• Set VerifyOptions.KeyUsages to []x509.ExtKeyUsage{x509.ExtKeyUsageAny}

from go-attestation.

sgtm

I think that'd be a good place to start anyway. We should also document why you need to use cert-transparency x509, and why UnhandledCriticalExtensions has to be set to nil. Ideally, we'd actually parse those extensions in the future too.

I feel like it might be reasonable to add a higher level API, expressing different trust models: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/tpm-key-attestation#BKMK_DeploymentOverview

But I think it'd be good to prototype that outside of attest, see what works and what doesn't, then propose the API here.

from go-attestation.

Do we not want to bundle the canonical trusted TPM roots?

https://go.microsoft.com/fwlink/?linkid=2097925

from go-attestation.