Parse and verify the signed Attestation Document

[petreeftime]

Given a COSE binary, provide an API to extract the Attestation Document from it and verify the signature against a given root(s) of trust.

[peiwenhu]

Hi, what's the status of this? Is there some existing library that helps verify an attestation document? thanks

[dreemkiller]

I have written something up that solves this issue for me, perhaps you will find it helpful (until AWS does it "officially" and "supported", in which case, definitely use theirs:
https://github.com/veracruz-project/nitro-enclave-attestation-document

[peiwenhu]

Thanks! That's very helpful

[paholg]

@petreeftime would you accept a PR that incorporates @dreemkiller's solution?

[richardfan1126]

I had written similar code in Python for this purpose: https://github.com/richardfan1126/nitro-enclave-python-demo/blob/master/attestation_verifier/secretstore/attestation_verifier.py

Given that verifying attestation documents is mostly the task of an external component which doesn't directly work with NSM, should this feature included in nsm-lib? Or should it be included in some other external tools like Nitro CLI?

[dreemkiller]

I've also written some golang that does this: https://github.com/veracruz-project/go-nitro-enclave-attestation-document

I'm not sure the best place to put an "AWS Approved" parser/verifier.