microsoft / microsoft/igvm

Delegate measurement information to TCG standards

Open
#61 13 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
155
Forks
42
Avg merge
23h 53m
Merged PRs (30d)
3

Description

Hi y'all, I'm not particularly familiar with this format but did learn from Jon Lange on the SVSM call that this is carrying measurement-specific data. I'd like to see what we can do about delegating those measurement specifics to the reference integrity manifest (RIM) information model that you can feed through the SP800155 unmeasured event type. The IETF is working on standardizing a CBOR-based actualization of the information model to deprecate the signed XML format the TCG previously specified, which they call CoRIM.

If IGVM can be expanded to specify QemuFwCfg file contents, then we can pass along signed IGVM measurement information to the user through a standard channel via the tcgSp800155PlatformIdEvent3 unmeasured event added in the TCG PC Client Platform Firmware Profile Version 1.06 Revision 52. Say we pass in the events via etc/sp800155evts, vis a vis https://github.com/tianocore/edk2/pull/5738.

I don't know how "generic" IGVM needs to be, since QemuFwCfg is something we use in our non-Qemu VMM at Google. Is this something y'all think is within IGVM's scope?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the proposed QemuFwCfg file contents and the etc/sp800155evts event path, then compare the referenced TCG SP800-155 and EDK2 PR 5738 material. Done means establishing whether IGVM should carry RIM or CoRIM measurement information and defining the scope of that support.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.