https://github.com/AMDESE/sev-guest

Tools, scripts, and configuration files necessary to demonstrate an end-to-end remote attestation example with SEV-SNP.
https://github.com/AMDESE/sev-guest

Last synced: 3 days ago
JSON representation

Tools, scripts, and configuration files necessary to demonstrate an end-to-end remote attestation example with SEV-SNP.

• Host: GitHub
• URL: https://github.com/AMDESE/sev-guest
• Owner: AMDESE
• License: apache-2.0
• Archived: true
• Created: 2021-09-30T17:31:19.000Z (about 3 years ago)
• Default Branch: main
• Last Pushed: 2024-01-26T19:10:39.000Z (10 months ago)
• Last Synced: 2024-08-03T01:25:50.492Z (3 months ago)
• Language: C
• Size: 439 KB
• Stars: 53
• Watchers: 13
• Forks: 27
• Open Issues: 25
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• Awesome-SGX-Open-Source - https://github.com/AMDESE/sev-guest

README

        
# ⚠ Deprecated ⚠

With the release of tooling by the [VirTEE](https://virtee.io) organization, this tool is now considered deprecated. Consult the following table for replacement tooling:

|Technologies|Replacement|

|-:|:-|

|Complete Library Support|[sev](https://github.com/virtee/sev)|

|Legacy SEV and SEV-ES|[sevctl](https://github.com/virtee/sevctl)|

|SEV-SNP Guest Tooling|[snpguest](https://github.com/virtee/snpguest)|

|SEV-SNP Host Tooling|[snphost](https://github.com/virtee/snphost)|

# SEV-SNP Attestation Examples

This repository contains source, scripts, and configuration files for several open source tools that can be used together to demonstrate one way to perform remote attestation of SEV-SNP guests.

Note that these materials are intended for educational use only and come with no guarantee of fitness for any purpose.

## Architectural Overviews

Architectural discussions and security considerations for each example are available in the [docs](docs) directory. Currently, this repository contains the following examples:

* [SSH Key Exchange](docs/ssh-key-exchange.md): Using remote attestation to securely exchange SSH public keys.

* Encrypted Disk Unlock: Using remote attestation to retrieve a disk encryption key and unlock an encrypted root filesystem.

## Example Setup

Installation instructions for the cloud host and the Guest Owner infrastructure are outlined below. Note that for simplicity, these two servers can be the same physical machine.

 * [Cloud Host Setup](docs/cloud-host-setup.md)

 * [Guest Owner Setup](docs/guest-owner-setup.md)

## Future Work

Future updates to this repository will include additional examples of how to perform the following tasks:

 - [x] Construct the ID Block for the SNP guest. (Done. Documentation pending. See `sev-host-identity --help` for more information.)

 - [ ] Verify the ID Block in the attestation report. (in progress)

 - [x] Shift the attestation flow to the initrd and receive a disk encryption key. (Done. Documentation pending. See [attestation/cryptsetup-initramfs](attestation/cryptsetup-initramfs))

---

## Resources

1. [AMD SEV-SNP ABI Specification (PDF)](https://www.amd.com/system/files/TechDocs/56860.pdf)

2. [AMD Signing Key (ASK) and AMD Root Key (ARK) Certificates for Milan Processors](https://developer.amd.com/wp-content/resources/ask_ark_milan.cert)