intel / intel/confidential-computing.tee.dcap

PCSClientTool depends on order of elements in JSON response of PCS

Open
#420 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
326
Forks
198
PR merge metrics
No merged PRs in 30d

Description

The PCSClientTool does not follow [the JSON specification](https://www.json.org/json-en.html) when parsing the response of the PCS when retrieving QE/QVE/TD_QE identity.

Specifically this section performs manual parsing of the JSON data: https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/fa6631cb98cba8a97f9d544aa9bd9d7438f0db87/tools/PccsAdminTool/lib/intelsgx/pcs.py#L691-L697

This code only works correctly when the response is ordered like the following:
```
{
"tcbInfo": {
//...
},
"signature"; ""
}
```

This only works correctly when the JSON data returned by the PCS always follows the same order, which seems to be no longer the case.

It is also not guaranteed by the JSON specification.
To quote from the specification:
> JSON is built on two structures:
> A collection of name/value pairs. In various languages, this is realized as an object, record, struct, dictionary, hash table, keyed list, or associative array.
> An ordered list of values. In most languages, this is realized as an array, vector, list, or sequence.

Since the PCS does not return an ordered list (array), but a collection of name/value pairs, the PCSClientTool should not depend on the ordering of said values.

Contributor guide

Open the contributing guide

Research direction

Start with the manual JSON parsing in tools/PccsAdminTool/lib/intelsgx/pcs.py around lines 691-697. Reproduce QE/QVE/TD_QE identity retrieval with the PCS response fields in a different order, then verify the tool handles both response orders correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.