test_common.go

package ccatoken

import (
	"crypto"
	"crypto/ecdsa"
	"crypto/elliptic"
	"encoding/hex"
	"reflect"
	"regexp"
	"testing"

	"github.com/lestrrat-go/jwx/v2/jwk"
	"github.com/stretchr/testify/require"
	"github.com/veraison/ccatoken/platform"
	cose "github.com/veraison/go-cose"
	"github.com/veraison/psatoken"
)

var (
	testRAK = `{
		"crv": "P-384",
		"d": "FKUwQqhmDMCf6ssJVx6x8GXnNnS2BPcTWI7UegRIyxAtTWCTA5VH5IAkDkVEbNM4",
		"kty": "EC",
		"x": "gRlYgKIgf7lWAyo8uX9dpa9yb_y3Fe4WR4Sn-xbAYJa92UYqMmULKRKoVRVw1uof",
		"y": "Oy0ffaiidfoAMw8AeGGLw-FJVJyBcNMuxViQp_nseJ8fGK6S6xXSIq-XHZccllrx"
	}`
	testRAKPubCOSE = []byte{
		0xa4, 0x01, 0x02, 0x20, 0x02, 0x21, 0x58, 0x30, 0x81, 0x19, 0x58, 0x80,
		0xa2, 0x20, 0x7f, 0xb9, 0x56, 0x03, 0x2a, 0x3c, 0xb9, 0x7f, 0x5d, 0xa5,
		0xaf, 0x72, 0x6f, 0xfc, 0xb7, 0x15, 0xee, 0x16, 0x47, 0x84, 0xa7, 0xfb,
		0x16, 0xc0, 0x60, 0x96, 0xbd, 0xd9, 0x46, 0x2a, 0x32, 0x65, 0x0b, 0x29,
		0x12, 0xa8, 0x55, 0x15, 0x70, 0xd6, 0xea, 0x1f, 0x22, 0x58, 0x30, 0x3b,
		0x2d, 0x1f, 0x7d, 0xa8, 0xa2, 0x75, 0xfa, 0x00, 0x33, 0x0f, 0x00, 0x78,
		0x61, 0x8b, 0xc3, 0xe1, 0x49, 0x54, 0x9c, 0x81, 0x70, 0xd3, 0x2e, 0xc5,
		0x58, 0x90, 0xa7, 0xf9, 0xec, 0x78, 0x9f, 0x1f, 0x18, 0xae, 0x92, 0xeb,
		0x15, 0xd2, 0x22, 0xaf, 0x97, 0x1d, 0x97, 0x1c, 0x96, 0x5a, 0xf1,
	}
	testIAK = `{
		"kty": "EC",
		"crv": "P-256",
		"x": "MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",
		"y": "4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM",
		"d": "870MB6gfuTJ4HtUnUvYMyJpr5eUZNP4Bk43bVdj3eAE"
	}`
	testAltIAK = `{
		"kty": "EC",
		"crv": "P-256",
		"x": "AtIf5xiADwKXrfB8-EPysL5zGNAGe15mP1bd9v72PcU",
		"y": "4HL-uTN8GEpq8HuAFfbWSeSOJJxRB1SJ96QGqt4mgLI",
		"d": "TGMozguxS9KKtFvoC0S6M6k6N9pGyzamd5q_dDEY0Bs"
	}`
	// https://git.trustedfirmware.org/TF-M/tf-m-tools.git/tree/iat-verifier/tests/data/cca_platform.pem
	// converted to JWK
	testRMMCPAK = `{
		"crv": "P-384",
		"d": "isCQyZWGn2GsE1jwKwIaJqtus4YgOsc1186YVVOLkfdMRLDVgCQ--3maKT3LqgiZ",
		"kty": "EC",
		"x": "IShnxS4rlQiwpCCpBWDzlNLfqiG911FP8akBr-fh94uxHU5m-Kijivp2r2oxxN6M",
		"y": "hM4tr8mWQli1P61xh3T0ViDREbF26DGOEYfbAjWjGNN7pZf-6A4OTHYqEryz6m7U"
	}`
)

var (
	testNotJSON            = []byte(`{`)
	testChallenge          = []byte("ABABABABABABABABABABABABABABABABABABABABABABABABABABABABABABABAB")
	testPersonalizationVal = []byte("ADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADAD")
	testInitMeas           = []byte("CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC")
	testExtensibleMeas     = [][]byte{
		testInitMeas,
		testInitMeas,
		testInitMeas,
		testInitMeas,
	}
	testHashAlgID       = "sha-256"
	testPubKeyHashAlgID = "sha-512"

	testPlatformLifecycleSecured = uint16(platform.LifecycleSecuredMin)
	testConfig                   = []byte{1, 2, 3}
	testImplementationID         = []byte{
		0, 0, 0, 0, 0, 0, 0, 0,
		0, 0, 0, 0, 0, 0, 0, 0,
		0, 0, 0, 0, 0, 0, 0, 0,
		0, 0, 0, 0, 0, 0, 0, 0,
	}
	testInstID = []byte{
		0x01, // RAND
		2, 2, 2, 2, 2, 2, 2, 2,
		2, 2, 2, 2, 2, 2, 2, 2,
		2, 2, 2, 2, 2, 2, 2, 2,
		2, 2, 2, 2, 2, 2, 2, 2,
	}
	testVSI              = "https://veraison.example/v1/challenge-response"
	testMeasurementValue = []byte{
		3, 3, 3, 3, 3, 3, 3, 3,
		3, 3, 3, 3, 3, 3, 3, 3,
		3, 3, 3, 3, 3, 3, 3, 3,
		3, 3, 3, 3, 3, 3, 3, 3,
	}
	testSignerID = []byte{
		4, 4, 4, 4, 4, 4, 4, 4,
		4, 4, 4, 4, 4, 4, 4, 4,
		4, 4, 4, 4, 4, 4, 4, 4,
		4, 4, 4, 4, 4, 4, 4, 4,
	}
	testSoftwareComponents = []psatoken.ISwComponent{
		&psatoken.SwComponent{
			MeasurementValue: &testMeasurementValue,
			SignerID:         &testSignerID,
		},
	}
	testCombinedClaimsJSON = `
	{
	  "cca-platform-token": {
		"cca-platform-profile": "tag:arm.com,2023:cca_platform#1.0.0",
		"cca-platform-challenge": "95Ub6AH+frD8OVYQcFjJFhNO4MZfddA3Fb8juWoXhNvKnP6P6hxG7/i/Y8RniYjQKr8aCr5ycn5joaT1a5v3nw==",
		"cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
		"cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC",
		"cca-platform-config": "AQID",
		"cca-platform-lifecycle": 12288,
		"cca-platform-sw-components": [
		  {
			"measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=",
			"signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ="
		  }
		],
		"cca-platform-service-indicator": "https://veraison.example/v1/challenge-response",
		"cca-platform-hash-algo-id": "sha-256"
	  },
	  "cca-realm-delegated-token": {
		"cca-realm-profile": "tag:arm.com,2023:realm#1.0.0",
		"cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==",
		"cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==",
		"cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==",
		"cca-realm-extensible-measurements": [
		  "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==",
		  "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==",
		  "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==",
		  "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw=="
		],
		"cca-realm-hash-algo-id": "sha-256",
		"cca-realm-public-key": "pAECIAIhWDCBGViAoiB/uVYDKjy5f12lr3Jv/LcV7hZHhKf7FsBglr3ZRioyZQspEqhVFXDW6h8iWDA7LR99qKJ1+gAzDwB4YYvD4UlUnIFw0y7FWJCn+ex4nx8YrpLrFdIir5cdlxyWWvE=",
		"cca-realm-public-key-hash-algo-id": "sha-512"
	  }
	}
	`
	testCombinedClaimsJSONMissingPlatform = `
	{
	  "cca-realm-delegated-token": {
		"cca-realm-challenge": "QUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQkFCQUJBQg==",
		"cca-realm-personalization-value": "QURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBREFEQURBRA==",
		"cca-realm-initial-measurement": "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==",
		"cca-realm-extensible-measurements": [
		  "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==",
		  "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==",
		  "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw==",
		  "Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQw=="
		],
		"cca-realm-hash-algo-id": "sha-256",
		"cca-realm-public-key": "BIEZWICiIH+5VgMqPLl/XaWvcm/8txXuFkeEp/sWwGCWvdlGKjJlCykSqFUVcNbqHzstH32oonX6ADMPAHhhi8PhSVScgXDTLsVYkKf57HifHxiukusV0iKvlx2XHJZa8Q==",
		"cca-realm-public-key-hash-algo-id": "sha-512"
	  }
	}
	`
	testCombinedClaimsJSONMissingRealm = `
	{
	  "cca-platform-token": {
		"cca-platform-profile": "http://arm.com/CCA-SSD/1.0.0",
		"cca-platform-challenge": "GiYROaq2dsJjIkODmlmKF+ZKgB+Xc3EGpwk/5Ilj71s/yc4A2WZsgA8MJgfddE3tSfarRAhlK71IP0zKrE6aiA==",
		"cca-platform-implementation-id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
		"cca-platform-instance-id": "AQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC",
		"cca-platform-config": "AQID",
		"cca-platform-lifecycle": 12288,
		"cca-platform-sw-components": [
		  {
			"measurement-value": "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM=",
			"signer-id": "BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ="
		  }
		],
		"cca-platform-service-indicator": "https://veraison.example/v1/challenge-response",
		"cca-platform-hash-algo-id": "sha-256"
	  }
	}
	`
	// nolint:gosec
	testGoodCCAToken = `
	d9018fa219acca590199d28443a10126a059014da919010978237461673a61726d2e
	636f6d2c323032333a6363615f706c6174666f726d23312e302e300a5840f7951be8
	01fe7eb0fc3956107058c916134ee0c65f75d03715bf23b96a1784dbca9cfe8fea1c
	46eff8bf63c4678988d02abf1a0abe72727e63a1a4f56b9bf79f19095c5820000000
	00000000000000000000000000000000000000000000000000000000001901005821
	01020202020202020202020202020202020202020202020202020202020202020219
	09614301020319095b19300019095f81a20258200303030303030303030303030303
	03030303030303030303030303030303030305582004040404040404040404040404
	04040404040404040404040404040404040404190960782e68747470733a2f2f7665
	726169736f6e2e6578616d706c652f76312f6368616c6c656e67652d726573706f6e
	7365190962677368612d3235365840f271afdc87a47a7f347eb10677ed998681819e
	d5d6acf02781c6b649cc49a18859415eea87819ad0cfcdaba5ecfc37468b0d530db2
	c445e3542f5a43d222e87619acd15902eed28444a1013822a0590281a8190109781c
	7461673a61726d2e636f6d2c323032333a7265616c6d23312e302e300a5840414241
	42414241424142414241424142414241424142414241424142414241424142414241
	42414241424142414241424142414241424142414241424142414219accb58404144
	41444144414441444144414441444144414441444144414441444144414441444144
	4144414441444144414441444144414441444144414441444144414419acce584043
	43434343434343434343434343434343434343434343434343434343434343434343
	434343434343434343434343434343434343434343434343434343434319accf8458
	40434343434343434343434343434343434343434343434343434343434343434343
	43434343434343434343434343434343434343434343434343434343434343584043
	43434343434343434343434343434343434343434343434343434343434343434343
	43434343434343434343434343434343434343434343434343434343435840434343
	43434343434343434343434343434343434343434343434343434343434343434343
	43434343434343434343434343434343434343434343434343434358404343434343
	43434343434343434343434343434343434343434343434343434343434343434343
	4343434343434343434343434343434343434343434343434319accc677368612d32
	353619accd586ba40102200221583081195880a2207fb956032a3cb97f5da5af726f
	fcb715ee164784a7fb16c06096bdd9462a32650b2912a8551570d6ea1f2258303b2d
	1f7da8a275fa00330f0078618bc3e149549c8170d32ec55890a7f9ec789f1f18ae92
	eb15d222af971d971c965af119acd0677368612d3531325860738916f034c55e6f03
	3194425a4edfaeacdfa2da1ba4c7a05b3c9c5d9128e9980343a46ac95115b9cab3db
	ed54028676ba0d5d8eb6ce2b454db27ae75a0f234f102d189d47f966e00223b1d27a
	0ccd14d880f95da740e87794a0b9edd12e5660
	`
	// nolint:gosec
	testBadUnwrappedTokens = `
	d9018fa219accad28443a10126a0590146a9190109781c687474703a2f2f61726d2e
	636f6d2f4343412d5353442f312e302e300a58401a261139aab676c2632243839a59
	8a17e64a801f97737106a7093fe48963ef5b3fc9ce00d9666c800f0c2607dd744ded
	49f6ab4408652bbd483f4ccaac4e9a8819095c582000000000000000000000000000
	00000000000000000000000000000000000000190100582101020202020202020202
	02020202020202020202020202020202020202020202021909614301020319095b19
	300019095f81a2025820030303030303030303030303030303030303030303030303
	03030303030303030558200404040404040404040404040404040404040404040404
	040404040404040404190960782e68747470733a2f2f7665726169736f6e2e657861
	6d706c652f76312f6368616c6c656e67652d726573706f6e7365190962677368612d
	3235365840383021598f4649f72b11c8c2c7eaefc61afb56a010bd43299d36faed28
	67a4713bb99f08adcfdab08acc299482bd743186d30812d8e700702ec3cd81dfb9ee
	9519acd1d28444a1013822a0590256a70a5840414241424142414241424142414241
	42414241424142414241424142414241424142414241424142414241424142414241
	42414241424142414241424142414219accb58404144414441444144414441444144
	41444144414441444144414441444144414441444144414441444144414441444144
	4144414441444144414441444144414419acce584043434343434343434343434343
	43434343434343434343434343434343434343434343434343434343434343434343
	434343434343434343434343434343434319accf8458404343434343434343434343
	43434343434343434343434343434343434343434343434343434343434343434343
	43434343434343434343434343434343434343584043434343434343434343434343
	43434343434343434343434343434343434343434343434343434343434343434343
	43434343434343434343434343434343435840434343434343434343434343434343
	43434343434343434343434343434343434343434343434343434343434343434343
	43434343434343434343434343434358404343434343434343434343434343434343
	43434343434343434343434343434343434343434343434343434343434343434343
	4343434343434343434343434319accc677368612d32353619accd58610418e0bd6e
	3242e43b0e60f5c9c4c510c8d9c528a05bd55b83b066fd64adc9c705cc712264ad9c
	ce8097fef539a22001c04885452c8beb0366bf12817a346b5e7bf9cd9ca641bcc2c5
	225030ce0832c4c7a9a09f389bb2b17d10aa04097c2c9a2419acd0677368612d3531
	325860fd3428320cc5a61532d77ac49baf254d91ca5f1eedffa70af203b1ec91ad86
	bcaa9eb03c14d06f763d93ccd5d4815c795e07ceaa02d772eb8b462c9f66ab938165
	835051f48f917e01212afe75b26e0412085f33e3a2438d24f3d551760e5636`

	// https://git.trustedfirmware.org/TF-M/tf-m-tools.git/tree/iat-verifier/tests/data/cca_token.cbor
	testRMMLegacyEvidence = `
	d9018fa219acca590293d28444a1013822a0590226a9190109781c687474
	703a2f2f61726d2e636f6d2f4343412d5353442f312e302e300a5820b597
	3cb68baa9fc55558786b7ec67f69e40df5ba5aa921cd0c27f40587a011ea
	19095c58207f454c4602010100000000000000000003003e000100000050
	5800000000000019010058210107060504030201000f0e0d0c0b0a090817
	161514131211101f1e1d1c1b1a191819096158210107060504030201000f
	0e0d0c0b0a090817161514131211101f1e1d1c1b1a191819095b19300319
	0962677368612d32353619095f84a50162424c0558200706050403020100
	0f0e0d0c0b0a090817161514131211101f1e1d1c1b1a19180465332e342e
	3202582007060504030201000f0e0d0c0b0a090817161514131211101f1e
	1d1c1b1a191806677368612d323536a401624d3105582007060504030201
	000f0e0d0c0b0a090817161514131211101f1e1d1c1b1a19180463312e32
	02582007060504030201000f0e0d0c0b0a090817161514131211101f1e1d
	1c1b1a1918a401624d3205582007060504030201000f0e0d0c0b0a090817
	161514131211101f1e1d1c1b1a19180465312e322e330258200706050403
	0201000f0e0d0c0b0a090817161514131211101f1e1d1c1b1a1918a40162
	4d3305582007060504030201000f0e0d0c0b0a090817161514131211101f
	1e1d1c1b1a191804613102582007060504030201000f0e0d0c0b0a090817
	161514131211101f1e1d1c1b1a19181909606c77686174657665722e636f
	6d5860201d3035e1cfa52abcf8b6d725a201018941bbe30f5019a86a3c5b
	d6305a39dd82d57a9dc645a831f78770dbc29b6c4d1313a43f159b846f17
	2c7af1e1c8281bc3f777324ce0bcb0c9f150e4a6d8e4749857cede857597
	675b6be91c8868131b19acd1590223d28444a1013822a05901b6a70a5840
	abababababababababababababababababababababababababababababab
	abababababababababababababababababababababababababababababab
	abababab19accc677368612d32353619acd0677368612d32353619accb58
	4054686520717569636b2062726f776e20666f78206a756d7073206f7665
	72203133206c617a7920646f67732e54686520717569636b2062726f776e
	20666f782019accd58610476f988091be585ed41801aecfab858548c6305
	7e16b0e676120bbd0d2f9c29e056c5d41a0130eb9c21517899dc23146b28
	e1b062bd3ea4b315fd219f1cbb528cb6e74ca49be16773734f61a1ca6103
	1b2bbf3d918f2f94ffc4228e50919544ae19acce58200000000000000000
	00000000000000000000000000000000000000000000000019accf845820
	000000000000000000000000000000000000000000000000000000000000
	000058200000000000000000000000000000000000000000000000000000
	000000000000582000000000000000000000000000000000000000000000
	000000000000000000005820000000000000000000000000000000000000
	00000000000000000000000000005860f3c498df6a8bbcc5824647c17953
	6e86c4f9b9a27a7aa69a54f6db328592dee15ebc68d7dcb6d1d256ee3129
	f27255a17a7e197aa44db12f37593274f33280b838332ae048b9ac7789ce
	4f38aec49fdd1e2378a1f3f127f2ee3182ee414124c5`
)

func mustHexDecode(t *testing.T, s string) []byte {
	// support CBOR-diag "pretty" format:
	// * allow long hex string to be split over multiple lines (with soft or
	//   hard tab indentation)
	// * allow comments starting with '#' up to the NL
	comments := regexp.MustCompile("#.*\n")
	emptiness := regexp.MustCompile("[ \t\n]")

	s = comments.ReplaceAllString(s, "")
	s = emptiness.ReplaceAllString(s, "")

	data, err := hex.DecodeString(s)
	if t != nil {
		require.NoError(t, err)
	} else if err != nil {
		panic(err)
	}
	return data
}

func signerFromJWK(t *testing.T, j string) cose.Signer {

	alg, key := getAlgAndKeyFromJWK(t, []byte(j))
	s, err := cose.NewSigner(alg, key)
	require.Nil(t, err)

	return s
}

func getAlgAndKeyFromJWK(t *testing.T, j []byte) (cose.Algorithm, crypto.Signer) {
	k, err := jwk.ParseKey(j)
	require.Nil(t, err)

	var (
		key crypto.Signer
		alg cose.Algorithm
	)

	err = k.Raw(&key)
	require.NoError(t, err)

	switch v := key.(type) {
	case *ecdsa.PrivateKey:
		switch v.Curve {
		case elliptic.P256():
			alg = cose.AlgorithmES256
		case elliptic.P384():
			alg = cose.AlgorithmES384
		default:
			require.True(t, false, "unknown elliptic curve")
		}
	default:
		require.True(t, false, "unknown private key type %v", reflect.TypeOf(key))
	}
	return alg, key
}

func pubKeyFromJWK(t *testing.T, j string) crypto.PublicKey {
	_, key := getAlgAndKeyFromJWK(t, []byte(j))
	vk := key.Public()
	return vk
}