From 3e3586cdb8a5bbf8b52a7bd62e5c3851e7f45be6 Mon Sep 17 00:00:00 2001 From: Alex van Poppelen Date: Tue, 7 Jan 2025 02:15:40 -0800 Subject: [PATCH 1/2] Add a field for the CSR signature to the MBM data. This proves the CSR was generated by the same device being attested. --- certz/certz.pb.go | 267 ++++++++++++++++++++++++---------------------- certz/certz.proto | 7 ++ 2 files changed, 146 insertions(+), 128 deletions(-) diff --git a/certz/certz.pb.go b/certz/certz.pb.go index aa76091..60fa666 100644 --- a/certz/certz.pb.go +++ b/certz/certz.pb.go @@ -2387,6 +2387,7 @@ type MBMData struct { AkPubKey string `protobuf:"bytes,5,opt,name=ak_pub_key,json=akPubKey,proto3" json:"ak_pub_key,omitempty"` AkAttestation []byte `protobuf:"bytes,6,opt,name=ak_attestation,json=akAttestation,proto3" json:"ak_attestation,omitempty"` AkSignature []byte `protobuf:"bytes,7,opt,name=ak_signature,json=akSignature,proto3" json:"ak_signature,omitempty"` + CsrSignature []byte `protobuf:"bytes,8,opt,name=csr_signature,json=csrSignature,proto3" json:"csr_signature,omitempty"` } func (x *MBMData) Reset() { @@ -2470,6 +2471,13 @@ func (x *MBMData) GetAkSignature() []byte { return nil } +func (x *MBMData) GetCsrSignature() []byte { + if x != nil { + return x.CsrSignature + } + return nil +} + var File_github_com_openconfig_gnsi_certz_certz_proto protoreflect.FileDescriptor var file_github_com_openconfig_gnsi_certz_certz_proto_rawDesc = []byte{ @@ -2778,7 +2786,7 @@ var file_github_com_openconfig_gnsi_certz_certz_proto_rawDesc = []byte{ 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x6e, 0x6f, 0x6e, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x6e, 0x6f, 0x6e, 0x63, 0x65, - 0x22, 0xed, 0x01, 0x0a, 0x07, 0x4d, 0x42, 0x4d, 0x44, 0x61, 0x74, 0x61, 0x12, 0x16, 0x0a, 0x06, + 0x22, 0x92, 0x02, 0x0a, 0x07, 0x4d, 0x42, 0x4d, 0x44, 0x61, 0x74, 0x61, 0x12, 0x16, 0x0a, 0x06, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x71, 0x75, 0x6f, 0x74, 0x65, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, @@ -2793,145 +2801,148 @@ var file_github_com_openconfig_gnsi_certz_certz_proto_rawDesc = []byte{ 0x61, 0x6b, 0x41, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x6b, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x61, 0x6b, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, - 0x2a, 0xcd, 0x0a, 0x0a, 0x08, 0x43, 0x53, 0x52, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x1f, 0x0a, - 0x1b, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, - 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x41, - 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, - 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, - 0x38, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, - 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x32, 0x35, 0x36, 0x10, - 0x01, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, - 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, - 0x32, 0x30, 0x34, 0x38, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, - 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, - 0x38, 0x34, 0x10, 0x02, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, - 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, - 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, - 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, - 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x03, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, - 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, - 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x33, 0x30, 0x37, 0x32, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, - 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, - 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x32, 0x35, 0x36, 0x10, 0x04, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, - 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, - 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x33, 0x30, 0x37, 0x32, 0x5f, 0x53, 0x49, - 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, - 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, 0x34, 0x10, 0x05, 0x12, 0x41, 0x0a, - 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, - 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x33, 0x30, 0x37, 0x32, - 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, - 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x06, - 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, - 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, - 0x30, 0x39, 0x36, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, - 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x32, 0x35, - 0x36, 0x10, 0x07, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, + 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x73, 0x72, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, + 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x63, 0x73, 0x72, 0x53, 0x69, 0x67, 0x6e, + 0x61, 0x74, 0x75, 0x72, 0x65, 0x2a, 0xcd, 0x0a, 0x0a, 0x08, 0x43, 0x53, 0x52, 0x53, 0x75, 0x69, + 0x74, 0x65, 0x12, 0x1f, 0x0a, 0x1b, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x43, + 0x49, 0x50, 0x48, 0x45, 0x52, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, + 0x44, 0x10, 0x00, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, - 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, + 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, - 0x5f, 0x33, 0x38, 0x34, 0x10, 0x08, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, + 0x5f, 0x32, 0x35, 0x36, 0x10, 0x01, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, - 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, + 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, + 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, + 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, 0x34, 0x10, 0x02, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, + 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, + 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x5f, 0x53, 0x49, 0x47, + 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, + 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x03, 0x12, 0x41, 0x0a, 0x3d, + 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, + 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x33, 0x30, 0x37, 0x32, 0x5f, + 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, + 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x32, 0x35, 0x36, 0x10, 0x04, 0x12, + 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, + 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x33, 0x30, + 0x37, 0x32, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, + 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, 0x34, + 0x10, 0x05, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, + 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, + 0x5f, 0x33, 0x30, 0x37, 0x32, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, + 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, + 0x35, 0x31, 0x32, 0x10, 0x06, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, + 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, + 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, + 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, + 0x5f, 0x32, 0x5f, 0x32, 0x35, 0x36, 0x10, 0x07, 0x12, 0x41, 0x0a, 0x3d, 0x43, 0x53, 0x52, 0x53, + 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, + 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x5f, 0x53, 0x49, 0x47, 0x4e, + 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, + 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, 0x34, 0x10, 0x08, 0x12, 0x41, 0x0a, 0x3d, 0x43, + 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, + 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x5f, 0x53, + 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, + 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x09, 0x12, 0x49, + 0x0a, 0x45, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, + 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x50, + 0x52, 0x49, 0x4d, 0x45, 0x32, 0x35, 0x36, 0x56, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, - 0x41, 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x09, 0x12, 0x49, 0x0a, 0x45, 0x43, 0x53, 0x52, + 0x41, 0x5f, 0x32, 0x5f, 0x32, 0x35, 0x36, 0x10, 0x0a, 0x12, 0x49, 0x0a, 0x45, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x50, 0x52, 0x49, 0x4d, 0x45, 0x32, 0x35, 0x36, 0x56, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, - 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x32, - 0x35, 0x36, 0x10, 0x0a, 0x12, 0x49, 0x0a, 0x45, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, + 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, + 0x38, 0x34, 0x10, 0x0b, 0x12, 0x49, 0x0a, 0x45, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x50, 0x52, 0x49, 0x4d, 0x45, 0x32, 0x35, 0x36, 0x56, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, - 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, 0x34, 0x10, 0x0b, 0x12, - 0x49, 0x0a, 0x45, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, + 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x0c, 0x12, + 0x48, 0x0a, 0x44, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, - 0x50, 0x52, 0x49, 0x4d, 0x45, 0x32, 0x35, 0x36, 0x56, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, - 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, - 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x0c, 0x12, 0x48, 0x0a, 0x44, 0x43, 0x53, - 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, - 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, - 0x38, 0x34, 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, - 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x32, - 0x35, 0x36, 0x10, 0x0d, 0x12, 0x48, 0x0a, 0x44, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, - 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, - 0x43, 0x44, 0x53, 0x41, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x5f, 0x53, - 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, - 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, 0x34, 0x10, 0x0e, 0x12, 0x48, - 0x0a, 0x44, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, - 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x53, - 0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, - 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, - 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x0f, 0x12, 0x48, 0x0a, 0x44, 0x43, 0x53, 0x52, 0x53, - 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, - 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, - 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, - 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x32, 0x35, 0x36, - 0x10, 0x10, 0x12, 0x48, 0x0a, 0x44, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, - 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, - 0x53, 0x41, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, - 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, - 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, 0x34, 0x10, 0x11, 0x12, 0x48, 0x0a, 0x44, - 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, - 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x53, 0x45, 0x43, - 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, - 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, - 0x5f, 0x35, 0x31, 0x32, 0x10, 0x12, 0x12, 0x28, 0x0a, 0x24, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, - 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, - 0x5f, 0x45, 0x44, 0x44, 0x53, 0x41, 0x5f, 0x45, 0x44, 0x32, 0x35, 0x35, 0x31, 0x39, 0x10, 0x13, - 0x2a, 0x4e, 0x0a, 0x0f, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x54, - 0x79, 0x70, 0x65, 0x12, 0x20, 0x0a, 0x1c, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, - 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, - 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, - 0x43, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x10, 0x01, - 0x2a, 0x95, 0x01, 0x0a, 0x13, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, - 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x24, 0x0a, 0x20, 0x43, 0x45, 0x52, 0x54, - 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x45, 0x4e, 0x43, 0x4f, 0x44, 0x49, 0x4e, 0x47, - 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1c, - 0x0a, 0x18, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x45, 0x4e, - 0x43, 0x4f, 0x44, 0x49, 0x4e, 0x47, 0x5f, 0x50, 0x45, 0x4d, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, - 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x45, 0x4e, 0x43, 0x4f, - 0x44, 0x49, 0x4e, 0x47, 0x5f, 0x44, 0x45, 0x52, 0x10, 0x02, 0x12, 0x1c, 0x0a, 0x18, 0x43, 0x45, - 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x45, 0x4e, 0x43, 0x4f, 0x44, 0x49, - 0x4e, 0x47, 0x5f, 0x43, 0x52, 0x54, 0x10, 0x03, 0x32, 0xc6, 0x04, 0x0a, 0x05, 0x43, 0x65, 0x72, - 0x74, 0x7a, 0x12, 0x5f, 0x0a, 0x06, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x65, 0x12, 0x27, 0x2e, 0x67, - 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x74, - 0x61, 0x74, 0x65, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, - 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, - 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x65, 0x43, 0x65, 0x72, 0x74, - 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, - 0x01, 0x30, 0x01, 0x12, 0x51, 0x0a, 0x0a, 0x41, 0x64, 0x64, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, - 0x65, 0x12, 0x20, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, - 0x31, 0x2e, 0x41, 0x64, 0x64, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, - 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, - 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x64, 0x64, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x52, 0x65, - 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, - 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x23, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, - 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x72, - 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x67, + 0x53, 0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, + 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, + 0x41, 0x5f, 0x32, 0x5f, 0x32, 0x35, 0x36, 0x10, 0x0d, 0x12, 0x48, 0x0a, 0x44, 0x43, 0x53, 0x52, + 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, + 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, 0x38, + 0x34, 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, + 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, + 0x34, 0x10, 0x0e, 0x12, 0x48, 0x0a, 0x44, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, + 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, + 0x44, 0x53, 0x41, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x5f, 0x53, 0x49, + 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, + 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x0f, 0x12, 0x48, 0x0a, + 0x44, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, + 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x53, 0x45, + 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, + 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, + 0x32, 0x5f, 0x32, 0x35, 0x36, 0x10, 0x10, 0x12, 0x48, 0x0a, 0x44, 0x43, 0x53, 0x52, 0x53, 0x55, + 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, + 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, + 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, + 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x33, 0x38, 0x34, 0x10, + 0x11, 0x12, 0x48, 0x0a, 0x44, 0x43, 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, + 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, + 0x41, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x5f, 0x53, 0x49, 0x47, 0x4e, + 0x41, 0x54, 0x55, 0x52, 0x45, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, + 0x53, 0x48, 0x41, 0x5f, 0x32, 0x5f, 0x35, 0x31, 0x32, 0x10, 0x12, 0x12, 0x28, 0x0a, 0x24, 0x43, + 0x53, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x58, 0x35, 0x30, 0x39, 0x5f, 0x4b, 0x45, 0x59, + 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x44, 0x44, 0x53, 0x41, 0x5f, 0x45, 0x44, 0x32, 0x35, + 0x35, 0x31, 0x39, 0x10, 0x13, 0x2a, 0x4e, 0x0a, 0x0f, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, + 0x63, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x20, 0x0a, 0x1c, 0x43, 0x45, 0x52, 0x54, + 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, + 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x43, 0x45, + 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x58, + 0x35, 0x30, 0x39, 0x10, 0x01, 0x2a, 0x95, 0x01, 0x0a, 0x13, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, + 0x69, 0x63, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x24, 0x0a, + 0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x45, 0x4e, 0x43, + 0x4f, 0x44, 0x49, 0x4e, 0x47, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, + 0x44, 0x10, 0x00, 0x12, 0x1c, 0x0a, 0x18, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, + 0x54, 0x45, 0x5f, 0x45, 0x4e, 0x43, 0x4f, 0x44, 0x49, 0x4e, 0x47, 0x5f, 0x50, 0x45, 0x4d, 0x10, + 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, + 0x5f, 0x45, 0x4e, 0x43, 0x4f, 0x44, 0x49, 0x4e, 0x47, 0x5f, 0x44, 0x45, 0x52, 0x10, 0x02, 0x12, + 0x1c, 0x0a, 0x18, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x45, + 0x4e, 0x43, 0x4f, 0x44, 0x49, 0x4e, 0x47, 0x5f, 0x43, 0x52, 0x54, 0x10, 0x03, 0x32, 0xc6, 0x04, + 0x0a, 0x05, 0x43, 0x65, 0x72, 0x74, 0x7a, 0x12, 0x5f, 0x0a, 0x06, 0x52, 0x6f, 0x74, 0x61, 0x74, + 0x65, 0x12, 0x27, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, + 0x31, 0x2e, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x65, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, + 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x67, 0x6e, 0x73, + 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x74, 0x61, 0x74, + 0x65, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, + 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x51, 0x0a, 0x0a, 0x41, 0x64, 0x64, 0x50, + 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x20, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, + 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x64, 0x64, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, + 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, + 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x64, 0x64, 0x50, 0x72, 0x6f, 0x66, + 0x69, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0d, 0x44, + 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x23, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, - 0x65, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, - 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x0e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, - 0x4c, 0x69, 0x73, 0x74, 0x12, 0x24, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, - 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x4c, - 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x67, 0x6e, 0x73, - 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, - 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, - 0x65, 0x12, 0x5d, 0x0a, 0x0e, 0x43, 0x61, 0x6e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, - 0x43, 0x53, 0x52, 0x12, 0x24, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, - 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x61, 0x6e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x43, - 0x53, 0x52, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x67, 0x6e, 0x73, 0x69, - 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x61, 0x6e, 0x47, 0x65, 0x6e, - 0x65, 0x72, 0x61, 0x74, 0x65, 0x43, 0x53, 0x52, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, - 0x12, 0x6f, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x69, 0x74, 0x79, - 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x12, 0x2a, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, - 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x74, 0x65, - 0x67, 0x72, 0x69, 0x74, 0x79, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x52, 0x65, 0x71, - 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, - 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x69, 0x74, - 0x79, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, - 0x65, 0x42, 0x21, 0x5a, 0x1f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, - 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2f, 0x67, 0x6e, 0x73, 0x69, 0x2f, - 0x63, 0x65, 0x72, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x65, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, + 0x74, 0x1a, 0x24, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, + 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x52, + 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x0e, 0x47, 0x65, 0x74, 0x50, 0x72, + 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x24, 0x2e, 0x67, 0x6e, 0x73, 0x69, + 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, + 0x66, 0x69, 0x6c, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, + 0x25, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, + 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, + 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x0e, 0x43, 0x61, 0x6e, 0x47, 0x65, 0x6e, + 0x65, 0x72, 0x61, 0x74, 0x65, 0x43, 0x53, 0x52, 0x12, 0x24, 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, + 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x61, 0x6e, 0x47, 0x65, 0x6e, 0x65, + 0x72, 0x61, 0x74, 0x65, 0x43, 0x53, 0x52, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, + 0x2e, 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x43, + 0x61, 0x6e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x43, 0x53, 0x52, 0x52, 0x65, 0x73, + 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6f, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x74, 0x65, + 0x67, 0x72, 0x69, 0x74, 0x79, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x12, 0x2a, 0x2e, + 0x67, 0x6e, 0x73, 0x69, 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, + 0x74, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x69, 0x74, 0x79, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, + 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x67, 0x6e, 0x73, 0x69, + 0x2e, 0x63, 0x65, 0x72, 0x74, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x6e, 0x74, + 0x65, 0x67, 0x72, 0x69, 0x74, 0x79, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x52, 0x65, + 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x21, 0x5a, 0x1f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, + 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2f, + 0x67, 0x6e, 0x73, 0x69, 0x2f, 0x63, 0x65, 0x72, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, + 0x33, } var ( diff --git a/certz/certz.proto b/certz/certz.proto index 466d244..d66f613 100644 --- a/certz/certz.proto +++ b/certz/certz.proto @@ -751,4 +751,11 @@ message MBMData { // and section 11.3.4 of // https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part2_Structures_pub.pdf#page=153. protolint:disable:this MAX_LINE_LENGTH bytes ak_signature = 7; + + // The signature over the CSR in a `TPMT_SIGNATURE` structure. See section + // 18.3 of + // https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_pub.pdf#page=163 protolint:disable:this MAX_LINE_LENGTH + // and section 11.3.4 of + // https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part2_Structures_pub.pdf#page=153. protolint:disable:this MAX_LINE_LENGTH + bytes csr_signature = 8; } From 98e32113e7fb191c432205643b35a96f986a8961 Mon Sep 17 00:00:00 2001 From: Alex van Poppelen Date: Wed, 8 Jan 2025 07:22:42 -0800 Subject: [PATCH 2/2] Update the MBM attestation workflow documentation. --- certz/README.md | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/certz/README.md b/certz/README.md index d724770..6fa874e 100644 --- a/certz/README.md +++ b/certz/README.md @@ -199,15 +199,19 @@ Call `Certz.GetIntegrityManifest`. The `Certz.GetIntegrityManifestResponse`'s PCRs to be included and all allowable digest values. Send a `Certz.GenerateCSRRequest` to the `Certz.Rotate` endpoint, containing a -`Certz.ReferenceIntegritySpec`. Using the returned `Certz.GenerateCSRResponse`, -do the following. Verify the EK certificate chain, and verify the -AK by nonce and certification by EK. Validate PCR digest as signed by the -validated AK. Verify the digest matches with one of the allowed ones. Lastly, -validate the CSR by its AK signature, and then process and extract the public -key. - -Get a new certificate issued by a trusted CA using the public key. Then -`Certz.Rotate` as normal. +`Certz.ReferenceIntegritySpec`. Using the returned `Certz.GenerateCSRResponse` +and the `MBMData` within, do the following: + +* Verify the `ek_leaf_cert` using the `ek_cert_chain` and your trust anchor. +* Validate the `ak_signature` over the `ak_attestation` struct which was + certified by the EK, and validate its contents. This verifies the AK. +* Validate the `signature` over `quoted` by the AK. Then validate that the PCRs + match one of the allowed ones. +* Validate the `csr_signature` over the `certificate_signing_request` by the AK. + This verifies the CSR. + +Get a new certificate issued by a trusted CA using the CSR. Then `Certz.Rotate` +as normal. ### Open Questions/Considerations