Add CWT support for C++

WORKSPACE

@@ -16,6 +16,7 @@
 
 workspace(name = "oak")
 
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 # The `name` argument in all `http_archive` rules should be equal to the
@@ -184,6 +185,19 @@ load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_depende
 # https://bazelbuild.github.io/rules_foreign_cc/0.9.0/flatten.html#rules_foreign_cc_dependencies
 rules_foreign_cc_dependencies()
 
+# C++ CBOR support.
+# https://android.googlesource.com/platform/external/libcppbor
+git_repository(
+ name = "libcppbor",
+ build_file = "@//:third_party/google/libcppbor/BUILD",
+ # Head commit on 2023-12-04.
+ commit = "20d2be8672d24bfb441d075f82cc317d17d601f8",
+ patches = [
+ "@//:third_party/google/libcppbor/remove_macro.patch",
+ ],
+ remote = "https://android.googlesource.com/platform/external/libcppbor",
+)
+
 http_archive(
  name = "cose_lib",
  build_file = "@//:third_party/BUILD.cose_lib",
@@ -192,11 +206,6 @@ http_archive(
  url = "https://github.com/android/cose-lib/archive/refs/tags/v2023.09.08.tar.gz",
 )
 
-load(
- "@bazel_tools//tools/build_defs/repo:git.bzl",
- "git_repository",
-)
-
 # Run clang-tidy on C++ code with the following command:
 # bazel build //cc/... \
 # --aspects=@bazel_clang_tidy//clang_tidy:clang_tidy.bzl%clang_tidy_aspect \

cc/utils/cose/BUILD

@@ -0,0 +1,65 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+package(
+ default_visibility = ["//visibility:public"],
+ licenses = ["notice"],
+)
+
+# Libraries
+
+cc_library(
+ name = "cose",
+ srcs = ["cose.cc"],
+ hdrs = ["cose.h"],
+ deps = [
+ "@com_google_absl//absl/status",
+ "@com_google_absl//absl/status:statusor",
+ "@com_google_absl//absl/strings",
+ "@libcppbor",
+ ],
+)
+
+cc_library(
+ name = "cwt",
+ srcs = ["cwt.cc"],
+ hdrs = ["cwt.h"],
+ deps = [
+ ":cose",
+ "@com_google_absl//absl/status",
+ "@com_google_absl//absl/status:statusor",
+ "@com_google_absl//absl/strings",
+ "@libcppbor",
+ ],
+)
+
+# Tests
+
+cc_test(
+ name = "cwt_test",
+ size = "small",
+ srcs = ["cwt_test.cc"],
+ data = [
+ "//oak_attestation_verification/testdata:evidence.textproto",
+ ],
+ deps = [
+ ":cwt",
+ "//proto/attestation:evidence_cc_proto",
+ "@com_google_absl//absl/strings",
+ "@com_google_googletest//:gtest_main",
+ "@com_google_protobuf//:protobuf",
+ ],
+)

cc/utils/cose/cose.cc

@@ -0,0 +1,144 @@
+/*
+ * Copyright 2024 The Project Oak Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "cc/utils/cose/cose.h"
+
+#include <cstdint>
+#include <memory>
+#include <utility>
+#include <vector>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "libcppbor/include/cppbor/cppbor.h"
+#include "libcppbor/include/cppbor/cppbor_parse.h"
+
+namespace oak::utils::cose {
+
+absl::StatusOr<CoseSign1> CoseSign1::Deserialize(absl::string_view data) {
+ auto [item, end, error] =
+ cppbor::parse(reinterpret_cast<const uint8_t*>(data.data()), data.size());
+ if (!error.empty()) {
+ return absl::InvalidArgumentError(absl::StrCat("couldn't parse COSE_Sign1: ", error));
+ }
+ if (item->type() != cppbor::ARRAY) {
+ return UnexpectedCborTypeError("COSE_Sign1", cppbor::ARRAY, item->type());
+ }
+ const cppbor::Array* array = item->asArray();
+ if (array->size() != 4) {
+ return absl::InvalidArgumentError(
+ absl::StrCat("invalid COSE_Sign1 CBOR array size, expected 4, found ", array->size()));
+ }
+
+ const auto& protected_headers = array->get(0);
+ if (protected_headers->type() != cppbor::BSTR) {
+ return UnexpectedCborTypeError("protected_headers", cppbor::BSTR, protected_headers->type());
+ }
+ const auto& unprotected_headers = array->get(1);
+ if (unprotected_headers->type() != cppbor::MAP) {
+ return UnexpectedCborTypeError("unprotected_headers", cppbor::MAP, unprotected_headers->type());
+ }
+ const auto& payload = array->get(2);
+ if (payload->type() != cppbor::BSTR) {
+ return UnexpectedCborTypeError("payload", cppbor::BSTR, payload->type());
+ }
+ const auto& signature = array->get(3);
+ if (signature->type() != cppbor::BSTR) {
+ return UnexpectedCborTypeError("signature", cppbor::BSTR, signature->type());
+ }
+
+ return CoseSign1(protected_headers->asBstr(), unprotected_headers->asMap(), payload->asBstr(),
+ signature->asBstr(), std::move(item));
+}
+
+absl::StatusOr<CoseKey> CoseKey::DeserializeHpkePublicKey(absl::string_view data) {
+ auto [item, end, error] =
+ cppbor::parse(reinterpret_cast<const uint8_t*>(data.data()), data.size());
+ if (!error.empty()) {
+ return absl::InvalidArgumentError(absl::StrCat("couldn't parse COSE_Key: ", error));
+ }
+ return DeserializeHpkePublicKey(std::move(item));
+}
+
+absl::StatusOr<CoseKey> CoseKey::DeserializeHpkePublicKey(const std::vector<uint8_t>& data) {
+ auto [item, end, error] = cppbor::parse(data);
+ if (!error.empty()) {
+ return absl::InvalidArgumentError(absl::StrCat("couldn't parse COSE_Key: ", error));
+ }
+ return DeserializeHpkePublicKey(std::move(item));
+}
+
+absl::StatusOr<CoseKey> CoseKey::DeserializeHpkePublicKey(std::unique_ptr<cppbor::Item>&& item) {
+ if (item->type() != cppbor::MAP) {
+ return UnexpectedCborTypeError("COSE_Key", cppbor::MAP, item->type());
+ }
+ const cppbor::Map* map = item->asMap();
+ if (map->size() < 5) {
+ return absl::InvalidArgumentError(
+ absl::StrCat("invalid COSE_Key CBOR map size, expected >= 5, found ", map->size()));
+ }
+
+ const auto& kty = map->get<int, int>(KTY);
+ if (kty == nullptr) {
+ return absl::InvalidArgumentError("KTY not found");
+ }
+ if (kty->type() != cppbor::UINT) {
+ return UnexpectedCborTypeError("KTY", cppbor::UINT, kty->type());
+ }
+ const auto& kid = map->get<int, int>(KID);
+ if (kid == nullptr) {
+ return absl::InvalidArgumentError("KID not found");
+ }
+ if (kid->type() != cppbor::BSTR) {
+ return UnexpectedCborTypeError("KID", cppbor::BSTR, kid->type());
+ }
+ const auto& alg = map->get<int, int>(ALG);
+ if (alg == nullptr) {
+ return absl::InvalidArgumentError("ALG not found");
+ }
+ if (alg->type() != cppbor::NINT) {
+ return UnexpectedCborTypeError("ALG", cppbor::NINT, alg->type());
+ }
+ const auto& key_ops = map->get<int, int>(KEY_OPS);
+ if (key_ops == nullptr) {
+ return absl::InvalidArgumentError("KEY_OPS not found");
+ }
+ if (key_ops->type() != cppbor::ARRAY) {
+ return UnexpectedCborTypeError("key_ops", cppbor::ARRAY, key_ops->type());
+ }
+
+ const auto& crv = map->get<int, int>(CRV);
+ if (crv == nullptr) {
+ return absl::InvalidArgumentError("CRV not found");
+ }
+ if (crv->type() != cppbor::UINT) {
+ return UnexpectedCborTypeError("CRV", cppbor::UINT, crv->type());
+ }
+ const auto& x = map->get<int, int>(X);
+ if (x == nullptr) {
+ return absl::InvalidArgumentError("X not found");
+ }
+ if (x->type() != cppbor::BSTR) {
+ return UnexpectedCborTypeError("X", cppbor::BSTR, x->type());
+ }
+
+ return CoseKey(kty->asUint(), kid->asBstr(), alg->asNint(), key_ops->asArray(), crv->asUint(),
+ x->asBstr(), std::move(item));
+}
+
+} // namespace oak::utils::cose

cc/utils/cose/cose.h

@@ -0,0 +1,143 @@
+/*
+ * Copyright 2024 The Project Oak Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef CC_UTILS_COSE_COSE_H_
+#define CC_UTILS_COSE_COSE_H_
+
+#include <cstdint>
+#include <memory>
+#include <string>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "libcppbor/include/cppbor/cppbor.h"
+#include "libcppbor/include/cppbor/cppbor_parse.h"
+
+namespace oak::utils::cose {
+
+// COSE_Sign1 object.
+// <https://datatracker.ietf.org/doc/html/rfc8152#section-4.2>
+class CoseSign1 {
+ public:
+ // Parameters about the current layer that are to be cryptographically protected.
+ const cppbor::Bstr* protected_headers;
+ // Parameters about the current layer that are not cryptographically protected.
+ const cppbor::Map* unprotected_headers;
+ // Serialized content to be signed.
+ const cppbor::Bstr* payload;
+ // Array of signatures. Each signature is represented as a COSE_Signature structure.
+ const cppbor::Bstr* signature;
+
+ static absl::StatusOr<CoseSign1> Deserialize(absl::string_view data);
+
+ private:
+ // Parsed CBOR item containing COSE_Sign1 object.
+ std::unique_ptr<cppbor::Item> item_;
+
+ CoseSign1(const cppbor::Bstr* protected_headers, const cppbor::Map* unprotected_headers,
+ const cppbor::Bstr* payload, const cppbor::Bstr* signature,
+ std::unique_ptr<cppbor::Item>&& item)
+ : protected_headers(protected_headers),
+ unprotected_headers(unprotected_headers),
+ payload(payload),
+ signature(signature),
+ item_(std::move(item)) {}
+};
+
+// COSE_Key object.
+// <https://www.rfc-editor.org/rfc/rfc8152#section-7>
+class CoseKey {
+ public:
+ // Identification of the key type.
+ const cppbor::Uint* kty;
+ // Key identification value.
+ const cppbor::Bstr* kid;
+ // Key usage restriction to this algorithm.
+ const cppbor::Nint* alg;
+ // Restrict set of permissible operations.
+ const cppbor::Array* key_ops;
+
+ // EC identifier.
+ const cppbor::Uint* crv;
+ // Public key.
+ const cppbor::Bstr* x;
+
+ // Deserializes HPKE public key as a COSE_Key.
+ // <https://www.rfc-editor.org/rfc/rfc9180.html>
+ static absl::StatusOr<CoseKey> DeserializeHpkePublicKey(absl::string_view data);
+ static absl::StatusOr<CoseKey> DeserializeHpkePublicKey(const std::vector<uint8_t>& data);
+
+ const std::vector<uint8_t>& GetPublicKey() const { return x->value(); }
+
+ private:
+ enum Parameter : int {
+ KTY = 1,
+ KID = 2,
+ ALG = 3,
+ KEY_OPS = 4,
+ BASE_IV = 5,
+
+ // IANA COSE_Key parameters.
+ // <https://www.iana.org/assignments/cose/cose.xhtml#key-common-parameters>
+ CRV = -1, // EC identifier.
+ X = -2, // Public key.
+ };
+
+ // Parsed CBOR item containing COSE_Key object.
+ std::unique_ptr<cppbor::Item> item_;
+
+ CoseKey(const cppbor::Uint* kty, const cppbor::Bstr* kid, const cppbor::Nint* alg,
+ const cppbor::Array* key_ops, const cppbor::Uint* crv, const cppbor::Bstr* x,
+ std::unique_ptr<cppbor::Item>&& item)
+ : kty(kty), kid(kid), alg(alg), key_ops(key_ops), crv(crv), x(x), item_(std::move(item)) {}
+
+ static absl::StatusOr<CoseKey> DeserializeHpkePublicKey(std::unique_ptr<cppbor::Item>&& item);
+};
+
+std::string CborTypeToString(cppbor::MajorType cbor_type) {
+ switch (cbor_type) {
+ case cppbor::MajorType::UINT:
+ return "UINT";
+ case cppbor::MajorType::NINT:
+ return "NINT";
+ case cppbor::MajorType::BSTR:
+ return "BSTR";
+ case cppbor::MajorType::TSTR:
+ return "TSTR";
+ case cppbor::MajorType::ARRAY:
+ return "ARRAY";
+ case cppbor::MajorType::MAP:
+ return "MAP";
+ case cppbor::MajorType::SEMANTIC:
+ return "SEMANTIC";
+ case cppbor::MajorType::SIMPLE:
+ return "SIMPLE";
+ default:
+ return absl::StrCat("UNKNOWN(", cbor_type, ")");
+ }
+}
+
+absl::Status UnexpectedCborTypeError(std::string_view name, cppbor::MajorType expected,
+ cppbor::MajorType found) {
+ return absl::InvalidArgumentError(absl::StrCat("expected ", name, " to have ",
+ CborTypeToString(expected), " CBOR type, found ",
+ CborTypeToString(found)));
+}
+
+} // namespace oak::utils::cose
+
+#endif // CC_UTILS_COSE_COSE_H_