COCOS-560 - EAT

[SammyOina]

What type of PR is this?

What does this do?

• New Features

  • Added Entity Attestation Token (EAT) support with configurable JWT or CBOR encoding formats.
  • Introduced EAT validation policies including format enforcement, token age limits, required claims, and signature verification.
  • Extended attestation service to support multiple platform types with platform-specific claim extraction.

• Chores

  • Updated attestation response format from Quote to EAT token payload.
  • Added required dependencies for CBOR encoding and COSE signing support.

Flow 1: Direct API Attestation

sequenceDiagram
    participant Agent as CVM Agent<br/>(Attester)
    participant AttSvc as Attestation Service<br/>(Evidence Generator)
    participant CLI as CLI<br/>(Verifier + Relying Party)
    participant Policy as Attestation Policy<br/>(Reference Values)
    
    Note over Agent,CLI: Direct Attestation API Call
    
    CLI->>Agent: Request Attestation(nonce)
    Agent->>AttSvc: FetchAttestation(nonce, platform_type)
    
    Note over AttSvc: 1. Get binary report from TEE<br/>2. Extract platform claims<br/>3. Create EAT token<br/>4. Sign with ECDSA key
    
    AttSvc-->>Agent: EAT Token (JWT/CBOR)
    Agent-->>CLI: EAT Token
    
    Note over CLI: Verifier Role
    CLI->>Policy: Load attestation policy
    Policy-->>CLI: EAT validation rules
    
    Note over CLI: 1. Decode EAT token<br/>2. Verify signature<br/>3. Validate claims vs policy<br/>4. Check nonce freshness<br/>5. Extract binary report<br/>6. Verify platform attestation
    
    CLI->>CLI: Make trust decision
    
    Note over CLI: Relying Party Role<br/>Trust established ✓

Loading

Flow 2: Attested TLS Handshake

sequenceDiagram
    participant Client as CLI<br/>(Relying Party)
    participant Agent as CVM Agent<br/>(Attester)
    participant AttSvc as Attestation Service<br/>(Evidence Generator)
    participant Policy as Attestation Policy<br/>(Reference Values)
    
    Note over Client,Agent: TLS Handshake with Attestation
    
    Client->>Agent: ClientHello + SNI(nonce.nonce)
    
    Note over Agent: Certificate Provider
    Agent->>Agent: Generate ephemeral key pair
    Agent->>Agent: Extract nonce from SNI
    
    Agent->>AttSvc: Attest(pubkey, nonce)
    
    Note over AttSvc: 1. Hash(pubkey + nonce)<br/>2. Get binary report from TEE<br/>3. Extract platform claims<br/>4. Create EAT token (CBOR)<br/>5. Sign token
    
    AttSvc-->>Agent: EAT Token (CBOR)
    
    Note over Agent: 1. Create X.509 cert<br/>2. Embed EAT in extension<br/>3. Sign cert with ephemeral key
    
    Agent-->>Client: ServerHello + Certificate<br/>(with EAT in extension)
    
    Note over Client: Certificate Verifier Role
    Client->>Policy: Load attestation policy
    Policy-->>Client: EAT validation rules
    
    Note over Client: 1. Extract EAT from cert extension<br/>2. Decode EAT token<br/>3. Verify EAT signature<br/>4. Validate claims vs policy<br/>5. Verify nonce matches<br/>6. Extract binary report<br/>7. Verify platform attestation<br/>8. Verify cert signature
    
    Client->>Client: Make trust decision
    
    Note over Client: Relying Party Role<br/>TLS connection established ✓
    
    Client->>Agent: Encrypted application data

Loading

Component Mapping

RFC 9711 Role	Cocos Component	Responsibilities
Attester	CVM Agent + Attestation Service	- Access TEE hardware - Generate binary attestation reports - Create EAT tokens with claims - Sign evidence
Evidence	EAT Token (JWT/CBOR)	- Contains platform claims - Includes measurements - Embeds binary report - Cryptographically signed
Verifier	CLI (Certificate Verifier)	- Decode EAT tokens - Validate signatures - Check claims against policy - Verify platform attestation - Produce attestation results
Reference Values	Attestation Policy JSON	- Expected measurements - TCB versions - EAT validation rules - Platform configuration
Relying Party	CLI	- Receive attestation results - Make trust decisions - Establish secure connections - Execute computations
Attestation Results	Verification outcome	- Trust level established - TLS connection allowed/denied - Computation authorized

Which issue(s) does this PR fix/relate to?

• Resolves Feature: Use RATS EAT #560

Have you included tests for your changes?

Did you document any new/modified feature?

Notes

To be merged after #559

[codecov]

Codecov Report

❌ Patch coverage is 76.68712% with 76 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.79%. Comparing base (a3265bc) to head (5b9e9a8).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/attestation/eat/extractor.go	52.63%	35 Missing and 1 partial ⚠️
pkg/attestation/eat/decoder.go	83.33%	5 Missing and 6 partials ⚠️
pkg/attestation/eat/eat.go	79.16%	9 Missing and 1 partial ⚠️
pkg/attestation/eat/cbor_encoder.go	71.42%	4 Missing and 4 partials ⚠️
pkg/atls/certificate_verifier.go	72.22%	2 Missing and 3 partials ⚠️
pkg/attestation/eat/jwt_encoder.go	94.28%	1 Missing and 1 partial ⚠️
pkg/attestation/vtpm/vtpm.go	66.66%	2 Missing ⚠️
pkg/attestation/azure/snp.go	80.00%	1 Missing ⚠️
pkg/attestation/tdx/tdx.go	80.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #561      +/-   ##
==========================================
+ Coverage   69.49%   70.79%   +1.30%     
==========================================
  Files          85       91       +6     
  Lines        6075     6390     +315     
==========================================
+ Hits         4222     4524     +302     
+ Misses       1485     1462      -23     
- Partials      368      404      +36     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[danko-miladinovic]

Maybe we can have the same names as the Intel TDX EAT profile. Source:
https://docs.trustauthority.intel.com/main/articles/articles/ita/concept-policy-v2.html
https://portal.trustauthority.intel.com/[eat_profile](https://portal.trustauthority.intel.com/eat_profile.html).html

What do you think?

[danko-miladinovic]

Can we add the intuse claim. With the status general.
https://www.rfc-editor.org/rfc/rfc9711.html#name-intuse-intended-use-claim
https://www.rfc-editor.org/rfc/rfc9711.html#int-use-registry

General meaning this is the up-to-date (fresh) token.

[danko-miladinovic]

LGTM