From 36a2d76b70cbdfd54764ed541f2ce1d3db7ba7d4 Mon Sep 17 00:00:00 2001 From: Ming-Wei Shih Date: Thu, 16 Jul 2026 18:14:49 +0000 Subject: [PATCH] corim: remove sha1 dependency with hard-coded TAG IDs Signed-off-by: Ming-Wei Shih --- Cargo.toml | 2 +- igvm/src/corim/launch_measurement/builder.rs | 7 +--- igvm/src/corim/launch_measurement/mod.rs | 40 ++++++++++++++++---- 3 files changed, 35 insertions(+), 14 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 3e9f1be..8dceac6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -23,5 +23,5 @@ sha2 = { version = "0.11", default-features = false } static_assertions = "1.1" thiserror = "2.0" tracing = "0.1" -uuid = { version = "1", default-features = false, features = ["v5"] } +uuid = { version = "1", default-features = false } zerocopy = { version = "0.8.14", features = ["derive"] } diff --git a/igvm/src/corim/launch_measurement/builder.rs b/igvm/src/corim/launch_measurement/builder.rs index 9a17276..fc9d6e2 100644 --- a/igvm/src/corim/launch_measurement/builder.rs +++ b/igvm/src/corim/launch_measurement/builder.rs @@ -23,7 +23,6 @@ use uuid::Uuid; use super::platform_info; use super::profile::PROFILE_URI; use super::Error; -use super::TAG_ID_NAMESPACE; // `ResolvedMeasurement` is intentionally profile-specific. When a second // profile arrives, common shape -- e.g., `(mkey, digest_alg, digest)` -- @@ -61,11 +60,7 @@ pub(crate) fn build_corim_bytes( group: None, }; - let tag_id = Uuid::new_v5( - &TAG_ID_NAMESPACE, - format!("{}/{}", info.vendor, info.model).as_bytes(), - ) - .to_string(); + let tag_id = Uuid::from_bytes(info.tag_id).to_string(); let ref_meas = build_measurement_map(measurement); diff --git a/igvm/src/corim/launch_measurement/mod.rs b/igvm/src/corim/launch_measurement/mod.rs index 9f00e99..d51fb85 100644 --- a/igvm/src/corim/launch_measurement/mod.rs +++ b/igvm/src/corim/launch_measurement/mod.rs @@ -47,15 +47,36 @@ pub use igvm_defs::IgvmPlatformType; use crate::CorimTemplate; -/// Fixed namespace UUID for deterministic CoMID tag-id derivation. -/// -/// `tag-id = UUIDv5(TAG_ID_NAMESPACE, "{vendor}/{model}")` -pub const TAG_ID_NAMESPACE: uuid::Uuid = uuid::Uuid::from_bytes([ - 0x85, 0xf3, 0xf1, 0xc2, 0x22, 0xa8, 0x44, 0x1e, 0xa1, 0xb9, 0xbc, 0xcf, 0xb6, 0x3e, 0xd5, 0xf7, -]); - // -- Profile catalog ---------------------------------------------------- +// Fixed namespace UUID for deterministic CoMID tag-id derivation. +// +// The per-platform `tag_id` values in `known_platforms` are precomputed as +// `UUIDv5(TAG_ID_NAMESPACE, "{vendor}/{model}")` per RFC 9562 Sec. 4, where +// `TAG_ID_NAMESPACE` is the fixed namespace UUID +// `85f3f1c2-22a8-441e-a1b9-bccfb63ed5f7` +// (bytes: `85 f3 f1 c2 22 a8 44 1e a1 b9 bc cf b6 3e d5 f7`). They are +// hardcoded so the crate does not need a runtime SHA-1 implementation; the +// per-platform round-trip tests assert the resulting tag-id strings. + +/// Precomputed tag-id for the Intel/TDX platform +/// (`e0510081-7b78-5b2a-97a6-d73d890e07b6`). +const TDX_TAG_ID: [u8; 16] = [ + 0xe0, 0x51, 0x00, 0x81, 0x7b, 0x78, 0x5b, 0x2a, 0x97, 0xa6, 0xd7, 0x3d, 0x89, 0x0e, 0x07, 0xb6, +]; + +/// Precomputed tag-id for the AMD/SEV-SNP platform +/// (`77e8061e-4634-5e53-a848-d1d09e996843`). +const SEV_SNP_TAG_ID: [u8; 16] = [ + 0x77, 0xe8, 0x06, 0x1e, 0x46, 0x34, 0x5e, 0x53, 0xa8, 0x48, 0xd1, 0xd0, 0x9e, 0x99, 0x68, 0x43, +]; + +/// Precomputed tag-id for the Microsoft/VBS platform +/// (`2e29068e-e0fa-59e6-b0ff-3bfe09132e13`). +const VBS_TAG_ID: [u8; 16] = [ + 0x2e, 0x29, 0x06, 0x8e, 0xe0, 0xfa, 0x59, 0xe6, 0xb0, 0xff, 0x3b, 0xfe, 0x09, 0x13, 0x2e, 0x13, +]; + /// Internal record describing a platform's profile-defined measurement layout. pub(crate) struct PlatformInfo { pub vendor: &'static str, @@ -63,6 +84,8 @@ pub(crate) struct PlatformInfo { pub mkey: &'static str, pub digest_alg: i64, pub digest_len: usize, + /// Precomputed `UUIDv5(TAG_ID_NAMESPACE, "{vendor}/{model}")` bytes. + pub tag_id: [u8; 16], } /// Named Information Hash Algorithm ID for SHA-256 (RFC 6920). @@ -79,6 +102,7 @@ pub(crate) fn known_platforms() -> &'static [PlatformInfo] { mkey: "MRTD", digest_alg: NI_SHA384, digest_len: 48, + tag_id: TDX_TAG_ID, }, PlatformInfo { vendor: "AMD", @@ -86,6 +110,7 @@ pub(crate) fn known_platforms() -> &'static [PlatformInfo] { mkey: "MEASUREMENT", digest_alg: NI_SHA384, digest_len: 48, + tag_id: SEV_SNP_TAG_ID, }, PlatformInfo { vendor: "Microsoft", @@ -93,6 +118,7 @@ pub(crate) fn known_platforms() -> &'static [PlatformInfo] { mkey: "MEASUREMENT", digest_alg: NI_SHA256, digest_len: 32, + tag_id: VBS_TAG_ID, }, ] }