KBS: Update KBS protocol to 0.2.0 to fix JWE format due to RFC7516 #597

Xynnn007 · 2024-11-25T03:12:59Z

Fixes #583.

This patch does a bunch of fixes per RFC 7516.

AEAD Auth Tag is now expcilitly included inside the tag part.
Add new JWE algorithms RSA OAEP and ECDH-ES+A256KW
Mark RSA PKCS#1 v1.5 padding scheme as deprecated as it is not recommended.
Add unit tests based on josekit to check the compatibility of JWE used by Response.
Update rust toolchain to 1.83.0

Per RFC7516, the AEAD's auth tag should be included inside the JWE body. We fix this to align with trustee side confidential-containers/trustee#597 Signed-off-by: Xynnn007 <[email protected]>

Xynnn007 · 2024-11-25T03:24:59Z

Ok the test error happened because the guest-components side code is old. I just put another commit that references my repo to include the commit that includes the AEAD update.

I think we can merge GC side code firstly. Then go back to this PR. Then another PR on gc side to revert the test image change.

Cargo.toml

Per RFC7516, the AEAD's auth tag should be included inside the JWE body. We fix this to align with trustee side confidential-containers/trustee#597 Signed-off-by: Xynnn007 <[email protected]>

Xynnn007 · 2024-11-26T06:52:22Z

I removed the kbs_protocol updating commit. The CI must fail. We can merge confidential-containers/guest-components#820 (comment) first and I will add the kbs_protocol updating commit back to this PR to make the CI happy.

Xynnn007 · 2024-11-26T07:00:14Z

cc @deeglaze

Per RFC7516, the AEAD's auth tag should be included inside the JWE body. We fix this to align with trustee side confidential-containers/trustee#597 Signed-off-by: Xynnn007 <[email protected]>

Xynnn007 · 2024-12-02T03:53:52Z

Test locally and passed. Let's wait for virtee/kbs-types#45 to be merged and update the kbs-types crate rev.

Xynnn007 · 2024-12-02T04:04:41Z

kbs/docs/kbs_attestation_protocol.md

@@ -227,6 +229,12 @@ Encryption algorithm used to encrypt the output of the KBS service API.
 The output of the KBS service API. It must be encrypted with the KBS-generated
 ephemeral key.

+- `aad` (Required if AEAD is used)


Hi @tylerfanelli I added the aad and tag parts to this document. They all follow RFC7516. Thanks for the help from upstream kbs-types.

tylerfanelli · 2024-12-02T04:15:02Z

Test locally and passed. Let's wait for virtee/kbs-types#45 to be merged and update the kbs-types crate rev.

Released here.

Xynnn007 · 2024-12-18T02:05:12Z

I did some change upon the PR description. Compability tests are passed with josekit crate. Now we can wait for upstream PR to get merged and then I rebase the dep.

fitzthum

LGTM. Thanks for taking care of this

tylerfanelli · 2025-01-28T06:43:00Z

@Xynnn007 Is there any update on this? Changes still being made, or anything needed from kbs_types?

Xynnn007 · 2025-02-05T03:28:51Z

@Xynnn007 Is there any update on this? Changes still being made, or anything needed from kbs_types?

I have rebased the code and let's see CI on this PR and confidential-containers/guest-components#820. If both succeed, nothing else needed from kbs-types.

Xynnn007 · 2025-02-05T06:27:56Z

@tylerfanelli Looks fine now. Will you do a release for kbs-types?

tylerfanelli · 2025-02-06T00:02:22Z

@tylerfanelli Looks fine now. Will you do a release for kbs-types?

Sure, released.

Fixes confidential-containers#583. This commit does two things: 1. Fix JWE format to align with RFC 7516. 2. Use more strong algorithm for JWE. Due to RFC 7516, the JWE AEAD Auth Tag should be expcilitly be included inside the `tag` part. Before this commit, the tag is actually included as the suffix of the `ciphertext`. We fix this by expcilitly extract the tag and include it into the jwe body. Also, we fix the AAD calculation logic, s.t. derived from ProtectedHeader which is also specifiled by RFC7516. This should be align with the guest-components side. This commit supports the following JWE algorithms for KBS response: 1. RSA PKCS v1.5 Padding. This algorithm is not recommended but for compability it is still reserved. 2. RSA OAEP. 3. ECDH-ES-A256KW with curve P256. This is recommended as EC algorithms are more fast and safe. which algorithm is used is decided by the TEE public key sent by the client. Some more unit tests to test the compability is added to make sure the algorithm is implemented as standard. Both change will make the kbs_client not able to connect to the KBS. Thus we update the KBS protocol version from 0.1.1 to 0.2.0. Signed-off-by: Xynnn007 <[email protected]>

Some dependencies like [email protected] requires a rust toolchain version over 1.81.0. Thus we update this to 1.83.0 to track the latest rust toolchain. This commit also fixes lint error introduced by new version of rust toolchain. Signed-off-by: Xynnn007 <[email protected]>

KBS Build with default feature and KBS build with built-in CoCo AS feature are the same, thus we delete the duplicated one and add more information. Signed-off-by: Xynnn007 <[email protected]>

Xynnn007 · 2025-02-06T06:14:16Z

PLEASE DO NOT merge this until confidential-containers/guest-components#820 gets merged

Xynnn007 requested a review from a team as a code owner November 25, 2024 03:13

Xynnn007 mentioned this pull request Nov 25, 2024

AA/kbs_protocol: Update to 0.2.0 to fix JWE decryption logic due to RFC7516 confidential-containers/guest-components#820

Open

Xynnn007 force-pushed the fix-jwe branch from 2c9f3fd to ebe8740 Compare November 25, 2024 03:23

mythi reviewed Nov 25, 2024

View reviewed changes

Cargo.toml Outdated Show resolved Hide resolved

Xynnn007 force-pushed the fix-jwe branch from ebe8740 to 57d5ea2 Compare November 26, 2024 06:50

Xynnn007 mentioned this pull request Nov 27, 2024

JWE encryption is missing base64url-encoded protected header as AEAD #583

Open

Xynnn007 marked this pull request as draft November 27, 2024 03:42

Xynnn007 mentioned this pull request Nov 27, 2024

Update Response struct to follow RFC 7516 virtee/kbs-types#44

Merged

Xynnn007 force-pushed the fix-jwe branch from 57d5ea2 to 4e6ee5c Compare December 2, 2024 03:53

Xynnn007 force-pushed the fix-jwe branch 2 times, most recently from 7fb7897 to 56ae015 Compare December 2, 2024 04:02

Xynnn007 marked this pull request as ready for review December 2, 2024 04:03

Xynnn007 commented Dec 2, 2024

View reviewed changes

Xynnn007 changed the title ~~KBS: fix JWE format~~ KBS: Upadte KBS protocol to 0.2.0 to fix JWE format Dec 2, 2024

Xynnn007 changed the title ~~KBS: Upadte KBS protocol to 0.2.0 to fix JWE format~~ KBS: Upadte KBS protocol to 0.2.0 to fix JWE format due to RFC7516 Dec 2, 2024

Xynnn007 force-pushed the fix-jwe branch from 56ae015 to 99d53ee Compare December 2, 2024 05:39

Xynnn007 force-pushed the fix-jwe branch 3 times, most recently from 7b9e7c7 to 547ed02 Compare December 10, 2024 08:19

Xynnn007 requested review from mythi and mkulke December 11, 2024 02:21

Xynnn007 force-pushed the fix-jwe branch 10 times, most recently from bb4e4f1 to 6db712e Compare December 18, 2024 01:34

Xynnn007 marked this pull request as ready for review December 18, 2024 01:36

Xynnn007 marked this pull request as draft December 18, 2024 01:36

Xynnn007 marked this pull request as ready for review December 18, 2024 02:03

Xynnn007 requested a review from mkulke December 18, 2024 02:28

Xynnn007 force-pushed the fix-jwe branch from 6db712e to 4ca60d8 Compare December 19, 2024 01:54

fitzthum approved these changes Dec 20, 2024

View reviewed changes

Xynnn007 force-pushed the fix-jwe branch from 4ca60d8 to 50d3299 Compare February 5, 2025 02:49

Xynnn007 force-pushed the fix-jwe branch from 50d3299 to 696d560 Compare February 5, 2025 05:51

Xynnn007 force-pushed the fix-jwe branch from 696d560 to bf8d9ae Compare February 6, 2025 01:40

Xynnn007 added 3 commits February 6, 2025 09:50

ci: remove duplicated KBS test case

4f16990

KBS Build with default feature and KBS build with built-in CoCo AS feature are the same, thus we delete the duplicated one and add more information. Signed-off-by: Xynnn007 <[email protected]>

Xynnn007 force-pushed the fix-jwe branch from bf8d9ae to 4f16990 Compare February 6, 2025 01:50

tylerfanelli mentioned this pull request Feb 9, 2025

kbs/plugins: Add ID_KEY plugin #698

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KBS: Update KBS protocol to 0.2.0 to fix JWE format due to RFC7516 #597

KBS: Update KBS protocol to 0.2.0 to fix JWE format due to RFC7516 #597

Xynnn007 commented Nov 25, 2024 •

edited

Loading

Xynnn007 commented Nov 25, 2024 •

edited

Loading

Xynnn007 commented Nov 26, 2024 •

edited

Loading

Xynnn007 commented Nov 26, 2024

Xynnn007 commented Dec 2, 2024

Xynnn007 Dec 2, 2024 •

edited

Loading

tylerfanelli commented Dec 2, 2024

Xynnn007 commented Dec 18, 2024

fitzthum left a comment

tylerfanelli commented Jan 28, 2025

Xynnn007 commented Feb 5, 2025

Xynnn007 commented Feb 5, 2025

tylerfanelli commented Feb 6, 2025

Xynnn007 commented Feb 6, 2025

KBS: Update KBS protocol to 0.2.0 to fix JWE format due to RFC7516 #597

Are you sure you want to change the base?

KBS: Update KBS protocol to 0.2.0 to fix JWE format due to RFC7516 #597

Conversation

Xynnn007 commented Nov 25, 2024 • edited Loading

Xynnn007 commented Nov 25, 2024 • edited Loading

Xynnn007 commented Nov 26, 2024 • edited Loading

Xynnn007 commented Nov 26, 2024

Xynnn007 commented Dec 2, 2024

Xynnn007 Dec 2, 2024 • edited Loading

Choose a reason for hiding this comment

tylerfanelli commented Dec 2, 2024

Xynnn007 commented Dec 18, 2024

fitzthum left a comment

Choose a reason for hiding this comment

tylerfanelli commented Jan 28, 2025

Xynnn007 commented Feb 5, 2025

Xynnn007 commented Feb 5, 2025

tylerfanelli commented Feb 6, 2025

Xynnn007 commented Feb 6, 2025

Xynnn007 commented Nov 25, 2024 •

edited

Loading

Xynnn007 commented Nov 25, 2024 •

edited

Loading

Xynnn007 commented Nov 26, 2024 •

edited

Loading

Xynnn007 Dec 2, 2024 •

edited

Loading