CCA Evidence Verification

CCA Attestation Verification

Based on the evidence format described in Appendix A7.2.3 of Realm Management Monitor Specification.

Cryptographic Validation
1. Check signature on the platform token according to §4.4. of RFC9052, using pCPAK.
2. Extract RAK public key (pRAK) from realm token (Note: The pRAK is is encoded into the uncompressed form specified in SEC 1, Version 2.0, Section 2.3.3. In order to be used for verification, it typically needs to be converted into an x, y pair.)
3. Check signature on the realm token according to §4.4. of RFC9052, using pRAK.
4. Check the cryptographic binding between the platform and realm tokens:
  1. Extract pRAK from realm token
  2. Extract pRAK's hash algorithm identifier from the realm token
  3. Hash pRAK using said hash algorithm
  4. Extract nonce from the platform token
  5. Check nonce is the same as the value computed in step 1.iv.c
CCA RoT Lifecycle Check
1. Extract the CCA lifecycle claim from the platform token and ensure that it is "SECURED"
Mandatory Reference Values Checks
1. Match software component measurements claims from the platform token against the corresponding reference values
2. Match configuration claim from the platform token against the corresponding reference value
3. Match initial measurement from the realm token against the corresponding reference value
Optional Reference Values Checks
1. Match personalisation value claim in the realm token against the corresponding reference value
2. Match extensible measurements claim in the realm token against the corresponding reference value

NOTE: Steps 4.1 and 4.2 depend on the realm author's choice to use these optional features.