Title: Scheme/parsec-tpm: Add TPM vendor and model information #345

Sukuna0007Abhi · 2025-09-23T20:02:24Z

Description:
This PR implements support for TPM vendor and model information in TPM endorsements, addressing Issue #139.

Changes include:

Extended TaAttr structure with vendor and model fields
Added input validation and sanitization for security
Implemented comprehensive test coverage:
- Real-world TPM vendor/model combinations
- International character handling
- Security test cases
- Edge cases and input validation
Updated documentation with new fields and security considerations

Security Considerations:

Implemented strict input validation
Added sanitization for potentially dangerous inputs
Protected against injection attacks
Enforced character and length limits

Testing:

Added extensive test suite covering:
- Common TPM vendors (Infineon, STMicroelectronics, etc.)
- International vendor names (Unicode support)
- Security test cases (injection attempts)
- Edge cases and combinations
- Character type handling

Documentation:

Updated README.md with new field descriptions
Added security considerations
Included usage examples

Resolves: #139

Ready for Review sir @thomas-fossati @setrofim @yogeshbdeshpande

setrofim · 2025-10-01T10:14:56Z

scheme/parsec-tpm/README.md

+      "key": [{
+        "type": "pkix-base64-key",
+        "value": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETKRFE_RwSXooI8DdatPOYg_uiKm2XrtT_uEMEvqQZrwJHHcfw0c3WVzGoqL3Y_Q6xkHFfdUVqS2WWkPdKO03uw==",
+        "parameters": {


I don't believe CoRIM crypto keys have additional parameters. Is this some extension or proposed change to the spec?

Hi sir @setrofim You're absolutely right to question this - CoRIM crypto keys in the standard specification do not have additional parameters.

This is indeed a Veraison-specific extension to the CoRIM spec. The standard IETF CoRIM specification defines crypto keys with only type and value fields.

I've implemented this extension because:

TPM-specific needs: TPM vendor/model information doesn't map naturally to the standard environment.class structure used by other schemes (like PSA)

Parsec profile: This follows the custom Parsec TPM profile ("tag:github.com/parallaxsecond,2023-03-03:tpm") which allows for scheme-specific extensions

Optional & backward compatible: Existing CoRIMs continue to work - this only adds optional metadata
I've updated the documentation to clearly indicate this is a Veraison extension and not part of the standard CoRIM specification. The implementation validates against our specific profile rather than claiming standard compliance.

Should I consider an alternative approach that stays closer to standard CoRIM, or is this extension acceptable for the parsec-tpm scheme's specific requirements? Pls reply

crypto-key-type-choice offers "type choice" rather than "map" extension point. Meaning you cannot add fields to existing values, you can only add new types. So you cannot add parameters to, e.g., "pkix-base64-key", you'd need to define a whole new type, "pkix-base64-key-with-params" and register that as an extension to the type choice (and then do the same for every other variant that needs to be extended in this way).

Thanks for guiding sir @setrofim, understood

Ready for review sir

Sukuna0007Abhi · 2025-10-04T13:22:41Z

Ready for review sir @setrofim sir @yogeshbdeshpande sir @thomas-fossati

setrofim

LGTM

scheme/parsec-tpm/sanitize.go

scheme/parsec-tpm/sanitize_test.go

yogeshbdeshpande

Please check my comments!

yogeshbdeshpande · 2025-10-06T11:59:36Z

scheme/parsec-tpm/sanitize.go

@@ -0,0 +1,213 @@
+// Copyright 2024 Contributors to the Veraison project.


I am wondering this generic implementation of string validation and checking for specific patterns is applicable more generically across entire Services scheme and could be moved to services/common ??

I don't think this validation is particularly generic. For example, dangerousChars set does not include some punctuation that one may want to escape in other contexts (e.g. @, -, =, +, etc). Some checks (hasExcessiveRepitition, 'hasAbnormalDistribution`) use seemingly arbitrary thresholds. This all seems reasonable for Parsec/TPM (at least, for the prespective of someone not intimately familiar with the specs). However, if we want something generic, this is inadequate.

I'm not even sure we want generic santization -- different systems have different restriction on what they accept and what needs to be escaped (e.g. URL vs DB input vs environment/shell variables). It is better to do specific filtering/escaping at the point where it is relevant. Otherwise we just end up with iflters that are overly restrictive or result in excessive escaping.

ok, understood, thanks. Are these then coming from a spec reference for restriction in TPM specific scene setting?

Not that I'm aware of (as I've said -- I'm not familiar with the specs). But this looks like it's designed specifically to catch "unreasonable" vendor/model names. From that point of view, the implementation looks reasonable. But I would not accept this as a good generic santizer (not do I think it's necesarily a good idea to have one).

yogeshbdeshpande · 2025-10-06T16:41:27Z

@Sukuna0007Abhi Let us discuss this PR in Veraison Meeting on 07/10/2025

Sukuna0007Abhi · 2025-10-06T16:56:06Z

Sure sir, @yogeshbdeshpande will try my best, to explain properly 🙏

yogeshbdeshpande · 2025-10-08T16:55:48Z

scheme/parsec-tpm/README.md

+Both fields support:
+- Unicode characters (e.g., for international vendor names)
+- Special characters (allowed in both fields)
+- Variable length strings (no artificial length restrictions)


Suggested change

Both fields support:

- Unicode characters (e.g., for international vendor names)

- Special characters (allowed in both fields)

- Variable length strings (no artificial length restrictions)

Both fields support:

- Unicode characters (e.g., for international vendor names)

- Special characters (allowed in both fields)

- Variable length strings (no artificial length restrictions)

yogeshbdeshpande · 2025-10-08T16:56:09Z

scheme/parsec-tpm/README.md

+
+### CORIM Example
+
+To include vendor and model information in your CORIM manifest, add them to the `environment.class` section (following standard CoRIM specification). Here are several examples:


Suggested change

To include vendor and model information in your CORIM manifest, add them to the `environment.class` section (following standard CoRIM specification). Here are several examples:

To include vendor and model information in your CoRIM manifest, add them to the `environment.class` section (following standard CoRIM specification). Here are several examples:

yogeshbdeshpande · 2025-10-08T16:56:51Z

scheme/parsec-tpm/README.md

+  ]
+}
+```
+


I do not think we need additional example, just drop them

yogeshbdeshpande · 2025-10-08T16:57:37Z

scheme/parsec-tpm/README.md

+### Security Considerations
+
+When using vendor and model fields:
+
+1. **Input Validation**:
+   - Maximum length: 1024 characters
+   - Strings are trimmed of leading/trailing whitespace
+   - Basic sanitization is applied to prevent injection attacks
+   - Control characters are removed (except newline and tab)
+
+2. **Storage**:
+   - Fields are optional and won't affect TPM validation
+   - Unicode characters are preserved for international vendor names
+   - Dangerous characters are escaped to prevent injection
+
+3. **Best Practices**:
+   - Use consistent vendor/model identifiers
+   - Prefer official vendor names and model numbers
+   - Keep strings concise and meaningful
+   - Test with various character encodings if using international names
+
+Note: The vendor and model fields are always optional and are meant for informational purposes only. The TPM's security validation is based solely on its cryptographic identity and measurements.
+```
+```


We do not need any special Security Considerations for Vendor and Model, so please drop this section!

yogeshbdeshpande · 2025-10-08T16:58:02Z

scheme/parsec-tpm/corim_extractor.go

+		if env.Class.Vendor != nil {
+			vendor := string(*env.Class.Vendor)
+			// Trim and validate
+			vendor = sanitizeAndValidate(vendor)


Line 131 not needed!

yogeshbdeshpande · 2025-10-08T16:58:14Z

scheme/parsec-tpm/corim_extractor.go

+		if env.Class.Model != nil {
+			model := string(*env.Class.Model)
+			// Trim and validate
+			model = sanitizeAndValidate(model)


Line 139 not needed!

yogeshbdeshpande · 2025-10-08T16:58:36Z

scheme/parsec-tpm/corim_extractor.go

 func (o *CorimExtractor) SetProfile(profile string) {
 	o.Profile = profile
 }
+


Remove Lines 213 to 231

yogeshbdeshpande · 2025-10-08T16:58:54Z

scheme/parsec-tpm/sanitize.go

@@ -0,0 +1,213 @@
+// Copyright 2025 Contributors to the Veraison project.


File can be deleted!

yogeshbdeshpande · 2025-10-08T16:59:11Z

scheme/parsec-tpm/sanitize_test.go

@@ -0,0 +1,125 @@
+// Copyright 2025 Contributors to the Veraison project.


File can be deleted!

yogeshbdeshpande

See my all comments, please re-work on the PR!

yogeshbdeshpande · 2025-10-08T17:03:46Z

scheme/parsec-tpm/evidence_handler.go

 	VerifKey *string `json:"parsec-tpm.ak-pub"`
 	ClassID  *string `json:"parsec-tpm.class-id"`
 	InstID   *string `json:"parsec-tpm.instance-id"`
+	// Optional vendor information for the TPM


It is not just the Trust Anchor but the supply chain for SwAttr (line 24) which also has class, needs the Optional Vendor and Model information

Ok sir @yogeshbdeshpande

This change implements support for TPM vendor and model information in TPM endorsements (Issue veraison#139). The implementation includes: - Extended TaAttr structure with vendor and model fields - Input validation and sanitization for security - Comprehensive test coverage including: * Real-world TPM vendor/model combinations * International character handling * Security test cases * Edge cases and input validation - Updated documentation with new fields and security considerations Signed-off-by: Sukuna0007Abhi <[email protected]>

@setrofim

Following @setrofim's feedback that crypto-key-type-choice uses 'type choice' not 'map' extension point, refactored to comply with standard CoRIM specification. Changes: - REMOVED: key.Parameters approach (invalid per CoRIM spec) - ADDED: Extract vendor/model from environment.class (standard location) - Follows same pattern as PSA scheme - Fixed regex backreference issues in sanitization - Updated README with complete, valid CoRIM examples - Deleted ta_attrs.go and related test files (wrong approach) - All tests passing This addresses the review comment that we cannot add parameters to existing key types like 'pkix-base64-key'. Instead, vendor/model are now stored in the standard environment.class location. Resolves: CoRIM specification compliance issue Signed-off-by: Sukuna0007Abhi <[email protected]>

Signed-off-by: Sukuna0007Abhi <[email protected]> Co-authored-by: Yogesh Deshpande <[email protected]> Signed-off-by: Sukuna0007Abhi <[email protected]>

@yogeshbdeshpande

- Remove sanitization files (sanitize.go, sanitize_test.go) - Extract vendor/model directly without validation - Simplify README: keep one example, remove Security section - Add vendor/model support to SwAttr for supply chain Addresses feedback from sir @yogeshbdeshpande Signed-off-by: Sukuna0007Abhi <[email protected]>

Sukuna0007Abhi · 2025-10-09T21:42:28Z

Ready for review sir @yogeshbdeshpande

Sukuna0007Abhi changed the title ~~Title: scheme/parsec-tpm: Add TPM vendor and model information~~ Title: Scheme/parsec-tpm: Add TPM vendor and model information Sep 23, 2025

Sukuna0007Abhi mentioned this pull request Sep 28, 2025

Parsec TPM endorsements - consider extending with vendor and model info #139

Open

setrofim reviewed Oct 1, 2025

View reviewed changes

Sukuna0007Abhi force-pushed the feature/tpm-vendor-model branch from 67d95ec to 7949f54 Compare October 4, 2025 13:05

setrofim approved these changes Oct 6, 2025

View reviewed changes

yogeshbdeshpande reviewed Oct 6, 2025

View reviewed changes

scheme/parsec-tpm/sanitize.go Outdated Show resolved Hide resolved

yogeshbdeshpande reviewed Oct 6, 2025

View reviewed changes

scheme/parsec-tpm/sanitize_test.go Outdated Show resolved Hide resolved

yogeshbdeshpande reviewed Oct 6, 2025

View reviewed changes

yogeshbdeshpande reviewed Oct 8, 2025

View reviewed changes

scheme/parsec-tpm/README.md Outdated

]

}

```

Copy link

Collaborator

yogeshbdeshpande Oct 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not think we need additional example, just drop them

yogeshbdeshpande reviewed Oct 8, 2025

View reviewed changes

yogeshbdeshpande requested changes Oct 8, 2025

View reviewed changes

Sukuna0007Abhi and others added 5 commits October 9, 2025 21:36

Update scheme/parsec-tpm/sanitize.go

2bc0d50

Signed-off-by: Sukuna0007Abhi <[email protected]> Co-authored-by: Yogesh Deshpande <[email protected]> Signed-off-by: Sukuna0007Abhi <[email protected]>

Update scheme/parsec-tpm/sanitize_test.go

463513d

Signed-off-by: Sukuna0007Abhi <[email protected]> Co-authored-by: Yogesh Deshpande <[email protected]> Signed-off-by: Sukuna0007Abhi <[email protected]>

Sukuna0007Abhi force-pushed the feature/tpm-vendor-model branch from b3c6251 to 2b059c7 Compare October 9, 2025 21:37

Sukuna0007Abhi requested a review from yogeshbdeshpande October 9, 2025 21:42

		@@ -0,0 +1,213 @@
		// Copyright 2024 Contributors to the Veraison project.


		### CORIM Example

		To include vendor and model information in your CORIM manifest, add them to the `environment.class` section (following standard CoRIM specification). Here are several examples:

		@@ -0,0 +1,213 @@
		// Copyright 2025 Contributors to the Veraison project.

		@@ -0,0 +1,125 @@
		// Copyright 2025 Contributors to the Veraison project.

Title: Scheme/parsec-tpm: Add TPM vendor and model information #345

Are you sure you want to change the base?

Title: Scheme/parsec-tpm: Add TPM vendor and model information #345

Conversation

Sukuna0007Abhi commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Sukuna0007Abhi commented Oct 4, 2025

Uh oh!

setrofim left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande commented Oct 6, 2025

Uh oh!

Sukuna0007Abhi commented Oct 6, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Sukuna0007Abhi commented Oct 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Sukuna0007Abhi commented Sep 23, 2025 •

edited

Loading