Solidity AWS Nitro Attestation validator

This repo provides solidity contracts for the verification of attestations generated by AWS Nitro Enclaves, as outlined in this doc.

Note it costs around 63m gas to validate an attestation with no prior verified certs. You can break this up into smaller transactions by verifying each cert in the chain separately. You can call CertManager.verifyCert for each cert in the attestation cabundle.

Usage

1. Deploy the CertManager separately.
2. Validate Nitro attestation in your contract:

pragma solidity ^0.8.0;

import {NitroValidator} from "@nitro-validator/NitroValidator.sol";
import {CborDecode} from "@nitro-validator/CborDecode.sol";
import {CertManager} from "@nitro-validator/CertManager.sol";

contract Validator is NitroValidator {
    using CborDecode for bytes;

    uint256 public constant MAX_AGE = 60 minutes;
    bytes32 public constant PCR0 = keccak256("some PCR0 value");
    
    constructor(CertManager certManager) NitroValidator(certManager) {}

    function registerSigner(bytes calldata attestationTbs, bytes calldata signature) external onlyOwner {
        Ptrs memory ptrs = validateAttestation(attestationTbs, signature);
        bytes32 pcr0 = attestationTbs.keccak(ptrs.pcrs[0]);
        require(pcr0 == PCR0, "invalid pcr0 in attestation");
        require(ptrs.timestamp + MAX_AGE > block.timestamp, "attestation too old");

        bytes memory publicKey = attestationTbs.slice(ptrs.publicKey);
        // do something with the public key, user data, etc
    }
}

3. Convert an attestation document to a attestationTbs / signature (TBS means to-be-signed). Note it's cheaper to perform this conversion offchain (e.g. using cast call).

bytes memory attestation = hex"84..";
(bytes memory attestationTbs, bytes memory signature) = validator.decodeAttestationTbs(attestation);
validator.validateAttestation(attestationTbs, signature);

Build

forge install
forge build

Test

forge test