Skip to content

expectedvalues.md

Latest commit

 

History

History
52 lines (38 loc) · 2.33 KB

expectedvalues.md

File metadata and controls

52 lines (38 loc) · 2.33 KB
Raw

Expected Values

An expected value holds the "known good" values a rule compares a claim with. It links one element, one intent and one endpoint of the element.

Compulsory Fields

The compulsory fields are described below. The field itemid is generated by Jane and is a UUID4; this field should not be specified when adding a new element.

Field Type Description
itemid UUID4 Internally generated identifier
name String A short name for the expected value
description String A longer description
elementid UUID4 The element it applies to
intentid String The intent it applies to, e.g. std::intent::sha256::crtm::pcr0
endpointname String The element endpoint it applies to, e.g. tarzan
evs Dictionary The values themselves; see below

A rule that needs an expected value looks it up by the claim's element, intent and endpoint name; with none it gives MissingExpectedValue (9997).

EVS Section

The keys in evs are defined by the rules that read them. jp records them when it provisions an element, with the type: given for each intent in the provisioning file:

jp type Keys in evs Read by
tpm2quote attestedValue (the quote's PCR digest), firmwareVersion tpm2_attestedValue, tpm2_firmware
sysmachineid machineid sys_machineID_Agent
tpm2ekcert issuerurl (where the EK certificate's issuer certificates are: https, http or file URL) tpm2_ekCertIssuer
uefiefivars one key per UEFI variable (SecureBoot, PK, db, dbx, ...): hex, or sha256:<hex> for large values the UEFI_* rules

See Rules for which rules need an expected value.

Go Definition

The definition of the expected value structure can be found at https://github.com/iolivergithub/jane/blob/main/janeserver/structures/expectedValues.go

Example

{ "itemid" : "d4b76ce1-2b56-4346-aa11-546ea412d1e5", 
  "name" : "Work laptop firmware", 
  "description" : "Firmware values, specifically PCR0,2,4,7 for work laptop", 
  "elementid" : "c7219a2b-7d02-4c1f-bad7-50c4d3b2cd2a", 
   "intentid" : "std::intent::sha256::crtm::pcr0",
  "endpointname" : "tarzan",
  "evs" : { 
      "attestedValue" : "lR+zAH+TVf7g+QTNDVs9J0hD+VcbYNthM1RUQ2nfrsY=", 
      "firmwareVersion" : "19984793217276456" }
   }