On chain DCAP verification

teerex/sgx-verify/src/lib.rs

@@ -431,20 +431,24 @@ pub fn verify_dcap_quote(
 
 	let (fmspc, tcb_info) = extract_tcb_info(&certs[0])?;
 
-	const AUTHENTICATION_DATA_SIZE: usize = 32; // This is actually variable but assume 32 for now
+	// For this part some understanding of the document (Especially chapter A.4: Quote Format)
+	// Intel® Software Guard Extensions (Intel® SGX) Data Center Attestation Primitives: ECDSA Quote Library API
+	// https://download.01.org/intel-sgx/latest/dcap-latest/linux/docs/Intel_SGX_ECDSA_QuoteLibReference_DCAP_API.pdf
+
+	const AUTHENTICATION_DATA_SIZE: usize = 32; // This is actually variable but assume 32 for now. This is also hard-coded to 32 in the Intel DCAP repo
 	const DCAP_QUOTE_HEADER_SIZE: usize = core::mem::size_of::<DcapQuoteHeader>();
 	const REPORT_SIZE: usize = core::mem::size_of::<SgxReportBody>();
-	let isv_report_slice = &dcap_quote_raw[0..(DCAP_QUOTE_HEADER_SIZE + REPORT_SIZE)];
+	const QUOTE_SIGNATURE_DATA_LEN_SIZE: usize = core::mem::size_of::<u32>();
 
-	let attestation_key_offset = core::mem::size_of::<DcapQuoteHeader>() +
+	let attestation_key_offset = DCAP_QUOTE_HEADER_SIZE +
 		REPORT_SIZE +
-		core::mem::size_of::<u32>() +
+		QUOTE_SIGNATURE_DATA_LEN_SIZE +
 		REPORT_SIGNATURE_SIZE;
 	let authentication_data_offset = attestation_key_offset +
 		ATTESTATION_KEY_SIZE +
 		REPORT_SIZE +
 		REPORT_SIGNATURE_SIZE +
-		core::mem::size_of::<u16>();
+		core::mem::size_of::<u16>(); //Size of the QE authentication data. We ignore this for now and assume 32. See AUTHENTICATION_DATA_SIZE
 	let mut hash_data = [0u8; ATTESTATION_KEY_SIZE + AUTHENTICATION_DATA_SIZE];
 	hash_data[0..ATTESTATION_KEY_SIZE].copy_from_slice(
 		&dcap_quote_raw[attestation_key_offset..(attestation_key_offset + ATTESTATION_KEY_SIZE)],
@@ -453,6 +457,7 @@ pub fn verify_dcap_quote(
 		&dcap_quote_raw
 			[authentication_data_offset..(authentication_data_offset + AUTHENTICATION_DATA_SIZE)],
 	);
+	// Ensure that the hash matches the intel signed hash in the QE report. This establishes trust into the attestation key.
 	let hash = ring::digest::digest(&ring::digest::SHA256, &hash_data);
 	ensure!(
 		hash.as_ref() == &quote.quote_signature_data.qe_report.report_data.d[0..32],
@@ -466,10 +471,14 @@ pub fn verify_dcap_quote(
 
 	let peer_public_key =
 		signature::UnparsedPublicKey::new(&signature::ECDSA_P256_SHA256_FIXED, pub_key);
+	let isv_report_slice = &dcap_quote_raw[0..(DCAP_QUOTE_HEADER_SIZE + REPORT_SIZE)];
+	// Verify that the enclave data matches the signature generated by the trusted attestation key.
+	// This establishes trust into the data of the enclave we actually want to verify
 	peer_public_key
 		.verify(isv_report_slice, &quote.quote_signature_data.isv_enclave_report_signature)
 		.map_err(|_| "Failed to verify report signature")?;
 
+	// Verify that the QE report was signed by Intel. This establishes trust into the QE report.
 	let asn1_signature = encode_as_der(&quote.quote_signature_data.qe_report_signature)?;
 	verify_signature(&leaf_cert, qe_report_slice, &asn1_signature, &webpki::ECDSA_P256_SHA256)?;