sandbox-tee: check a TDX quote's PCK chain to a pinned Intel root #415

Merged

dcharlot merged 1 commit from feat/tdx-pck-chain into main 2026-10-22 06:51:25 -04:00

Conversation 0 Commits 1 Files changed 7 +351 -9

dcharlot commented 2026-10-21 19:12:02 -04:00

Owner

Copy link

#399 made verify_tdx trust only a PCK key the verifier pins, but left the pinning itself to the deployment: a hand pin, with nothing checking the quote's certificate chain to Intel's root. The SEV-SNP side has amd_kds for exactly this job.

sandbox-tee::intel_pcs (feature intel-pcs)

• verify_pck_chain(trusted_root_der, chain_pem, now_unix) checks the chain a quote carries (the PCK leaf, then its issuing CA, optionally ending in the root) to the pinned root:

  • ECDSA-P256-SHA256 signatures;
  • the declared signature algorithm;
  • issuer and subject names linking up the chain;
  • each certificate valid at now.

  A presented root must equal the pinned one byte for byte, and a longer chain is refused. It returns the PCK key, the TeeAnchor::Tdx a quote is verified by.

• pck_from_quote derives that anchor from the quote's own chain, checked to the root. The trust comes from the root, never from the quote.

• Not checked: revocation lists. Consulting them is the deployment's job, as the module states.

CI gap closed

The sandbox-rs CI job now runs cargo test -p sandbox-tee --features amd-kds,intel-pcs. The amd-kds tests had never run in CI, because a plain cargo test doesn't enable the feature.

Verification (build host)

• sandbox-tee with both features: 51 tests pass.
• The sandbox workspace: 434 tests pass.
• Clippy -D warnings is clean.
• Mutation testing: 10 mutants, all killed. They cover:
  • a presented root that isn't the pinned one;
  • the CA link, the leaf link, the names, both validity bounds, the algorithm, the signature;
  • an over-long chain;
  • returning the CA's key instead of the leaf's.
• Repo checks pass.

🤖 Generated with Claude Code

#399 made `verify_tdx` trust only a PCK key the **verifier pins**, but left the pinning itself to the deployment: a hand pin, with nothing checking the quote's certificate chain to Intel's root. The SEV-SNP side has `amd_kds` for exactly this job. ## `sandbox-tee::intel_pcs` (feature `intel-pcs`) - **`verify_pck_chain(trusted_root_der, chain_pem, now_unix)`** checks the chain a quote carries (the PCK leaf, then its issuing CA, optionally ending in the root) to the **pinned root**: - ECDSA-P256-SHA256 signatures; - the declared signature algorithm; - issuer and subject names linking up the chain; - each certificate valid at `now`. A presented root must equal the pinned one byte for byte, and a longer chain is refused. It returns the PCK key, the `TeeAnchor::Tdx` a quote is verified by. - **`pck_from_quote`** derives that anchor from the quote's own chain, checked to the root. The trust comes from the root, never from the quote. - **Not checked:** revocation lists. Consulting them is the deployment's job, as the module states. ## CI gap closed The `sandbox-rs` CI job now runs `cargo test -p sandbox-tee --features amd-kds,intel-pcs`. **The `amd-kds` tests had never run in CI**, because a plain `cargo test` doesn't enable the feature. ## Verification (build host) - **sandbox-tee with both features:** 51 tests pass. - **The sandbox workspace:** 434 tests pass. - **Clippy** `-D warnings` is clean. - **Mutation testing:** 10 mutants, all killed. They cover: - a presented root that isn't the pinned one; - the CA link, the leaf link, the names, both validity bounds, the algorithm, the signature; - an over-long chain; - returning the CA's key instead of the leaf's. - **Repo checks** pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-10-21 19:12:02 -04:00

sandbox-tee: check a TDX quote's PCK chain to a pinned Intel root ... ff06055e5c

#399 made verify_tdx trust only a PCK key the verifier pins, but left
pinning it to the deployment: a hand pin, with nothing checking the
quote's certificate chain to Intel's root. The SEV-SNP side has amd_kds
for exactly this.

intel_pcs (feature `intel-pcs`):
- verify_pck_chain(trusted_root_der, chain_pem, now_unix) checks the chain
  a quote carries, the PCK leaf then its issuing CA, optionally ending in
  the root, to the pinned root. It checks:
  - ECDSA-P256-SHA256 signatures, with the X.509 (r, s) decoded via der;
  - the declared algorithm;
  - issuer and subject names linking up the chain;
  - each certificate valid at now.
  A presented root must equal the pinned one byte for byte; a longer chain
  is refused. It returns the PCK key, the TeeAnchor::Tdx a quote is
  verified by.
- pck_from_quote derives that anchor from the quote's own chain, checked
  to the root. The trust comes from the root, never from the quote.
- Revocation lists are the deployment's to consult, as stated in the
  module.

tdx: TdxQuote::pck_chain(); local_quote takes optional certification data,
so a software quote can carry a real chain.

CI: the sandbox-rs job now runs `cargo test -p sandbox-tee --features
amd-kds,intel-pcs`. The amd-kds tests had never run in CI: a plain
`cargo test` does not enable the feature.

SPEC §7.6 and the §9 readiness row say the chain is checked.

Tests: 5, against a self-generated chain of Intel's structure:
- a chain to the pinned root yields the PCK, with or without the root;
- a chain to another root is refused, pinned or presented;
- every link must hold (a forged leaf or CA, a misnamed issuer, a missing
  CA, a chain too long, a relabeled algorithm);
- a chain outside its validity is refused;
- the anchor from a quote's chain verifies that quote and no other root
  yields one.
Mutation testing: 10 mutants, all killed.

Verified on the build host: sandbox-tee with amd-kds and intel-pcs, 51
tests; the sandbox workspace, 434; clippy -D warnings clean. Repo checks
pass, including workflow concurrency and lockfiles.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 87064143ac into main 2026-10-22 06:51:25 -04:00

dcharlot referenced this pull request from a commit 2026-10-22 06:51:25 -04:00

Merge pull request 'sandbox-tee: check a TDX quote's PCK chain to a pinned Intel root' (#415) from feat/tdx-pck-chain into main

dcharlot referenced this pull request from a commit 2026-10-22 06:53:22 -04:00

sandbox: a confidential run sealed on TDX hardware, its PCK checked to Intel's root

dcharlot referenced this pull request 2026-10-22 06:53:44 -04:00

sandbox: a confidential run sealed on TDX hardware, its PCK checked to Intel's root #436

dcharlot referenced this pull request from a commit 2026-10-25 23:50:24 -04:00

Merge origin/main (41c5bafba) into train/wai-c

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!415

No description provided.