Repository navigation
Move servtdTcbMapping as standalone component #1087
Description
See #1032 (comment)
I think currently we are using the layout below:
MigTD image
├── policy issuer chain (PEM, separate file) -> RTMR[1]; verifies the servtdTcbMapping signature
└── policyData (policy_v2_signed.json, no outer signature)
├── id, version "2.0", policySvn, policy / forward-policy / backward-policy -> RTMR[2]
├── collaterals (signed by Intel) -> RTMR[2]
└── servtdCollateral
├── servtdIdentityIssuerChain -> RTMR[2]
├── servtdIdentity (signed by the identity issuer) -> RTMR[2]
└── servtdTcbMapping (signed by the policy issuer) -> not measured
I feel it is a little weird to put servtdTcbMapping under servtdCollateral.
Can we move servtdTcbMapping up to root, like below?
MigTD image
├── policy issuer chain (PEM, separate file) -> RTMR[1]; verifies the servtdTcbMapping signature
└── policyData (policy_v2_signed.json, no outer signature)
├── id, version "2.0", policySvn, policy / forward-policy / backward-policy -> RTMR[2]
├── collaterals (signed by Intel) -> RTMR[2]
└── servtdCollateral
├── servtdIdentityIssuerChain -> RTMR[2]
└── servtdIdentity (signed by the identity issuer) -> RTMR[2]
└── servtdTcbMapping (signed by the policy issuer) -> not measured
The benefit is that the layout is consist with RTMR measurement.
We have {policy issuer chain, policyData, TcbMapping} under root.
1st node (policy issuer chain) is RTMR[1], 2nd node (policyData) is RTMR[2], 3rd node (TcbMapping) is not measured.
BTW: I propose to use the following
| V2 Component | File Type GUID | FFS Raw File Name |
|---|---|---|
| Policy Issuer Chain (PEM) | {09D30028-30CE-4C4C-8925-1D8884E1D507} | {3F2FB27A-9596-431C-A68D-D3EAB39F8AEB} |
| Policy Data | {3BDDBCA0-CAB7-41F5-AB63-E2833C96F500} | {0BE92DC3-6221-4C98-87C1-8EEFFD70DE5A} |
| Signed TCB Mapping | {B0E594D9-A2FF-42D3-994E-BC50B4F50C1C} | {8073AC3C-7D49-4DA9-9B20-4DC1D1DB3CFB} |
Activity