Nitro Attestation CLI

Author: Zaptoss

nitro-attestation-cli/Dockerfile

@@ -0,0 +1,28 @@
+FROM rust:1.81.0-slim-bookworm AS nsmlib-builder
+WORKDIR /workspace
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
+    apt-get install -y git
+RUN git clone https://github.com/aws/aws-nitro-enclaves-nsm-api.git && \
+    cd aws-nitro-enclaves-nsm-api && \
+    git checkout v0.4.0 && \
+    mkdir -p /workspace/target/lib && \
+    cargo build --release --manifest-path Cargo.toml -p nsm-lib && \
+    install target/release/libnsm.a /workspace/target/lib/libnsm.a
+
+FROM golang:1.23.1-bookworm AS nitro-attestation-cli-builder
+WORKDIR /workspace
+COPY pkgconfig /workspace/target/pkgconfig
+RUN for file in /workspace/target/pkgconfig/*.pc; do \
+    sed -i 's/\/path\/to\/lib/\/workspace\/target\/lib/g' "$file"; \
+    done
+COPY go.mod ./
+RUN go mod download
+COPY . ./
+COPY --from=nsmlib-builder /workspace/target/ target/
+RUN mkdir -p target/bin
+RUN PKG_CONFIG_PATH=/workspace/target/pkgconfig go build -o target/bin/nitro-attestation-cli .
+
+FROM debian:bookworm-slim AS nitro-attestation-cli
+COPY --from=nitro-attestation-cli-builder /workspace/target/bin/nitro-attestation-cli /usr/local/bin/
+ENTRYPOINT [ "nitro-attestation-cli" ]

nitro-attestation-cli/cmd/document/create.go

@@ -0,0 +1,55 @@
+package document
+
+import (
+	"encoding/hex"
+	"fmt"
+
+	"github.com/distributed-lab/enclave-extras/nitro-attestation-cli/internal/document"
+	"github.com/spf13/cobra"
+)
+
+var (
+	createPublicKey string
+	createUserData  string
+	createNonce     string
+)
+
+var createCmd = &cobra.Command{
+	Use:   "create",
+	Short: "",
+	Long:  "",
+	RunE: func(cmd *cobra.Command, args []string) (err error) {
+		var publicKey []byte
+		if len(createPublicKey) != 0 {
+			publicKey, err = hex.DecodeString(createPublicKey)
+			if err != nil {
+				return fmt.Errorf("invalid public key: %w", err)
+			}
+		}
+		var userData []byte
+		if len(createUserData) != 0 {
+			userData, err = hex.DecodeString(createUserData)
+			if err != nil {
+				return fmt.Errorf("invalid user data: %w", err)
+			}
+		}
+		var nonce []byte
+		if len(createNonce) != 0 {
+			nonce, err = hex.DecodeString(createNonce)
+			if err != nil {
+				return fmt.Errorf("invalid nonce: %w", err)
+			}
+		}
+		return document.CreateAttestationDocument(document.CreateAttestationDocumentOptions{
+			UserData:  userData,
+			Nonce:     nonce,
+			PublicKey: publicKey,
+		})
+	},
+}
+
+func init() {
+	createCmd.Flags().StringVar(&createPublicKey, "public-key", "", "Hex public key")
+	createCmd.Flags().StringVar(&createUserData, "user-data", "", "Hex user data")
+	createCmd.Flags().StringVar(&createNonce, "nonce", "", "Hex nonce")
+}

nitro-attestation-cli/cmd/document/document.go

@@ -0,0 +1,15 @@
+package document
+
+import (
+	"github.com/spf13/cobra"
+)
+
+var Cmd = &cobra.Command{
+	Use:   "document",
+	Short: "Create and read AWS Nitro Secure Module attestation documents",
+}
+
+func init() {
+	Cmd.AddCommand(createCmd)
+	Cmd.AddCommand(readCmd)
+}

nitro-attestation-cli/cmd/document/read.go

@@ -0,0 +1,55 @@
+package document
+
+import (
+	"fmt"
+
+	"github.com/distributed-lab/enclave-extras/nitro-attestation-cli/internal/document"
+	"github.com/spf13/cobra"
+)
+
+var (
+	readInput     string
+	readPublicKey bool
+	readUserData  bool
+	readNonce     bool
+	pcrsToVerify  = map[int]struct{}{}
+)
+
+var readCmd = &cobra.Command{
+	Use:   "read",
+	Short: "",
+	Long:  "",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return document.ReadAttestationDocument(document.ReadAttestationDocumentOptions{
+			UserData:     readUserData,
+			Nonce:        readNonce,
+			PublicKey:    readPublicKey,
+			Input:        readInput,
+			PCRsToVerify: pcrsToVerify,
+		})
+	},
+}
+
+func init() {
+	readCmd.Flags().StringVar(&readInput, "input", "", "Input file to read")
+	readCmd.Flags().BoolVar(&readPublicKey, "public-key", false, "Print public key as raw string")
+	readCmd.Flags().BoolVar(&readUserData, "user-data", false, "Print user data as raw string")
+	readCmd.Flags().BoolVar(&readNonce, "nonce", false, "Print nonce as raw string")
+
+	readCmd.MarkFlagRequired("input")
+	addVerifyPCRFlags(readCmd)
+}
+
+func addVerifyPCRFlags(cmd *cobra.Command) {
+	for pcr := 0; pcr < 32; pcr++ {
+		cmd.Flags().Bool(fmt.Sprintf("verify-pcr%d", pcr), false, fmt.Sprintf("Verify PCR %d", pcr))
+	}
+	cmd.PreRun = func(cmd *cobra.Command, args []string) {
+		for pcr := 0; pcr < 32; pcr++ {
+			val, err := cmd.Flags().GetBool(fmt.Sprintf("verify-pcr%d", pcr))
+			if err == nil && val {
+				pcrsToVerify[pcr] = struct{}{}
+			}
+		}
+	}
+}

nitro-attestation-cli/cmd/kms/create_key.go

@@ -0,0 +1,51 @@
+package kms
+
+import (
+	"fmt"
+
+	"github.com/distributed-lab/enclave-extras/nitro-attestation-cli/internal/kms"
+	"github.com/spf13/cobra"
+)
+
+var (
+	createKeyProfile      string
+	createKeyManagedKey   bool
+	createKeyIncludedPCRs = map[int]struct{}{}
+)
+
+var createKeyCmd = &cobra.Command{
+	Use:   "create-key",
+	Short: "",
+	Long:  "",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if createKeyProfile == "" {
+			createKeyProfile = "default"
+		}
+		return kms.CreateKey(kms.CreateKeyOptions{
+			Profile:     createKeyProfile,
+			ManagedKey:  createKeyManagedKey,
+			IncludePCRs: createKeyIncludedPCRs,
+		})
+	},
+}
+
+func init() {
+	createKeyCmd.Flags().StringVar(&createKeyProfile, "profile", "", "AWS Config profile")
+	createKeyCmd.Flags().BoolVar(&createKeyManagedKey, "managed-key", false, "Allow to root change key policies")
+
+	addIncludedPCRFlags(createKeyCmd)
+}
+
+func addIncludedPCRFlags(cmd *cobra.Command) {
+	for pcr := 0; pcr < 32; pcr++ {
+		cmd.Flags().Bool(fmt.Sprintf("pcr%d", pcr), false, fmt.Sprintf("Include PCR %d", pcr))
+	}
+	cmd.PreRun = func(cmd *cobra.Command, args []string) {
+		for pcr := 0; pcr < 32; pcr++ {
+			val, err := cmd.Flags().GetBool(fmt.Sprintf("pcr%d", pcr))
+			if err == nil && val {
+				createKeyIncludedPCRs[pcr] = struct{}{}
+			}
+		}
+	}
+}

nitro-attestation-cli/cmd/kms/decrypt.go

@@ -0,0 +1,37 @@
+package kms
+
+import (
+	"github.com/distributed-lab/enclave-extras/nitro-attestation-cli/internal/kms"
+	"github.com/spf13/cobra"
+)
+
+var (
+	decryptProfile string
+	decryptKeyID   string
+	decryptInput   string
+)
+
+var decryptCmd = &cobra.Command{
+	Use:   "decrypt",
+	Short: "",
+	Long:  "",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if decryptProfile == "" {
+			decryptProfile = "default"
+		}
+		return kms.Decrypt(kms.DecryptOptions{
+			Profile: decryptProfile,
+			Input:   decryptInput,
+			KeyID:   decryptKeyID,
+		})
+	},
+}
+
+func init() {
+	decryptCmd.Flags().StringVar(&decryptProfile, "profile", "", "AWS Config profile")
+	decryptCmd.Flags().StringVar(&decryptKeyID, "key-id", "", "AWS KMS key ID")
+	decryptCmd.Flags().StringVar(&decryptInput, "input", "", "Input file to decrypt")
+
+	decryptCmd.MarkFlagRequired("input")
+	decryptCmd.MarkFlagRequired("key-id")
+}

nitro-attestation-cli/cmd/kms/generate_data_key.go

@@ -0,0 +1,44 @@
+package kms
+
+import (
+	"fmt"
+
+	"github.com/distributed-lab/enclave-extras/nitro-attestation-cli/internal/kms"
+	"github.com/spf13/cobra"
+)
+
+var (
+	generateDataKeyProfile       string
+	generateDataKeyKeyID         string
+	generateDataKeyNumberOfBytes int32
+)
+
+var generateDataKeyCmd = &cobra.Command{
+	Use:   "generate-data-key",
+	Short: "",
+	Long:  "",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if generateDataKeyProfile == "" {
+			generateDataKeyProfile = "default"
+		}
+		// Nitro attestation use RSAES_OAEP_SHA_256 with max size 446 bit encrypted content
+		// https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
+		// 446 / 8 = 55
+		if generateDataKeyNumberOfBytes < 1 || generateDataKeyNumberOfBytes > 55 {
+			return fmt.Errorf("invalid number of bytes, must be between 1 and 55")
+		}
+		return kms.GenerateDataKey(kms.GenerateDataKeyOptions{
+			Profile:       generateDataKeyProfile,
+			KeyID:         generateDataKeyKeyID,
+			NumberOfBytes: generateDataKeyNumberOfBytes,
+		})
+	},
+}
+
+func init() {
+	generateDataKeyCmd.Flags().StringVar(&generateDataKeyProfile, "profile", "", "AWS Config profile")
+	generateDataKeyCmd.Flags().StringVar(&generateDataKeyKeyID, "key-id", "", "AWS KMS key ID")
+	generateDataKeyCmd.Flags().Int32Var(&generateDataKeyNumberOfBytes, "number-of-bytes", 32, "Key length")
+
+	generateDataKeyCmd.MarkFlagRequired("key-id")
+}

nitro-attestation-cli/cmd/kms/generate_data_key_pair.go

@@ -0,0 +1,16 @@
+package kms
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+var generateDataKeyPairCmd = &cobra.Command{
+	Use:   "generate-data-key-pair",
+	Short: "Not implemented!",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		fmt.Println("Not implemented!")
+		return nil
+	},
+}

nitro-attestation-cli/cmd/kms/generate_random.go

@@ -0,0 +1,16 @@
+package kms
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+var generateRandomCmd = &cobra.Command{
+	Use:   "generate-random",
+	Short: "Not implemented!",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		fmt.Println("Not implemented!")
+		return nil
+	},
+}

nitro-attestation-cli/cmd/kms/kms.go

@@ -0,0 +1,18 @@
+package kms
+
+import (
+	"github.com/spf13/cobra"
+)
+
+var Cmd = &cobra.Command{
+	Use:   "kms",
+	Short: "Interact with AWS KMS from enclave with attestation document",
+}
+
+func init() {
+	Cmd.AddCommand(createKeyCmd)
+	Cmd.AddCommand(decryptCmd)
+	Cmd.AddCommand(generateDataKeyCmd)
+	Cmd.AddCommand(generateDataKeyPairCmd)
+	Cmd.AddCommand(generateRandomCmd)
+}