1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
// Copyright 2023 The ChromiumOS Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
syntax = "proto3";
option optimize_for = LITE_RUNTIME;
package arc_attestation;
// CrOSVersionAttestationVersion is an enum that denotes the device type the
// blob is generated on and the version of the blob, for the ChromeOS Version
// Attestation Blob.
enum CrOSVersionAttestationVersion {
// CROS_BLOB_VERSION_UNSET indicates that the blob version is not set, server
// should reject this blob as invalid if this value is present.
CROS_BLOB_VERSION_UNSET = 0;
// CROS_BLOB_VERSION_TPM2_FORMAT_1 is the first version of ChromeOS-specific
// Blob used by devices with a TPM2.0 chip. This includes cr50 and ti50
// devices.
CROS_BLOB_VERSION_TPM2_FORMAT_1 = 1;
}
// This message is used to hold all information needed to remotely verify the
// ChromeOS version. It is designed to abstract away different underlying
// secure element or TPM.
message CrOSVersionAttestationBlob {
// Denotes the version and device this is generated on.
CrOSVersionAttestationVersion version = 1;
// A TPM certifying key is a key provisioned with the TPM's Attestation
// Identity Key (a key outlined in TPM standard) through the ChromeOS PCA
// (Privacy Certificate Authority). Its task is to certify any TPM related
// data in this blob, such as PCR or NVRAM Quotation.
// This field contains the entire x.509 cert chain.
// Currently, this field is populate for all supported devices and blob
// version.
bytes tpm_certifying_key_cert = 2;
// kernel_cmdline_quote contains a PCR quotation of the PCR that have the
// kernel commandline measured into it.
// For TPM2_FORMAT_1 version, this field will contain TPM2B_ATTEST, whereby
// extraData in TPM2B_ATTEST is set to the challenge.
// The quotation is generated with TPM2_PCR_QUOTE.
// Note that TPM2B_ATTEST and the TPMS_QUOTE_INFO within does not contain
// the PCR content itself, but the hash of it, therefore to verify it, the
// server side should:
// 1. Compute the hash of kernel_cmdline_content field below.
// 2. Simulate the PCR Extend process to compute the resulting PCR value.
// 3. Compute the hash of resulting PCR value and see if it matches what's
// in TPMS_QUOTE_INFO.
// Server side should also verify the quote PCR is PCR3.
bytes kernel_cmdline_quote = 3;
// Same as above, but contains the TPMT_SIGNATURE part of the quote in DER
// format.
bytes kernel_cmdline_quote_signature = 4;
// kernel_cmdline_content contains the raw content of /proc/cmdline.
// Its content can be verified together with the kernel_cmdline_quote above.
// Within the kernel command line, there's a key named
// "cros_lsb_release_hash" that contains the hex-encoded SHA256 hash of
// lsb_release_content field below.
// Currently, this field is populated for all supported devices and blob
// version.
bytes kernel_cmdline_content = 5;
// lsb_release_content contains the raw content of /etc/lsb-release
// This file contains the ChromeOS version. Note that not all fields in the
// file can be relied upon. See this document for more detail:
// https://chromium.googlesource.com/chromiumos/docs/+/HEAD/os_config.md#LSB
// Currently, this field is populated for all supported devices and blob
// version.
bytes lsb_release_content = 6;
// kernel_antirollback_quote contains an NVRAM quotation of the NVRAM that
// holds the kernel antirollback version.
// For TPM2_FORMAT_1 version, this field will contain the concatenation of
// TPM2B_NV_PUBLIC, TPM2B_ATTEST and TPMT_SIGNATURE, whereby extraData in
// TPM2B_ATTEST is set to the challenge.
// The quotation is generated with TPM2_NV_Certify.
// The NVRAM content is in TPM2B_ATTEST and can be verified directly.
bytes kernel_antirollback_quote = 7;
}
// This message is used to hold all additional information needed to validate
// a ChromeOS system for the purpose of Android Remote Key Provisioning (RKP).
message CrOSSpecificBlob {
// Records the version attestation information.
CrOSVersionAttestationBlob version_attestation = 1;
// device_key_certs contains the certificate chain for the device key used
// for Android Attestation. The certificate chain is presented with the
// certificate authority being last in the array. The leaf certificate in
// the chain (the first in the array) should be issued by Asbestos and have
// a X.509 subject with RDN O="ARC TPM Certifying Key".
repeated string device_key_certs = 2;
}
|
