package verify
import (
"crypto/ecdsa"
"crypto/sha256"
"crypto/x509"
"encoding/hex"
"fmt"
"github.com/fxamacker/cbor/v2"
)
func VerifyParserResponse(resp *ParseResponse) error {
// Step 1: Decode attestation
var doc AttestationDocument
if err := cbor.Unmarshal(resp.Attestation, &doc); err != nil {
return fmt.Errorf("decode attestation: %w", err)
}
// Step 2: Verify certificate chain
if err := verifyCertificateChain(doc.Certificate); err != nil {
return fmt.Errorf("verify cert chain: %w", err)
}
// Step 3: Check PCR values
if err := verifyPCRs(doc.PCRs); err != nil {
return fmt.Errorf("verify PCRs: %w", err)
}
// Step 4: Verify signature using attested public key
pubKey, err := parsePublicKey(doc.PublicKey)
if err != nil {
return fmt.Errorf("parse public key: %w", err)
}
// Step 5: Verify the transaction signature
hash := sha256.Sum256([]byte(resp.ParsedTransaction.Payload))
valid := ecdsa.VerifyASN1(pubKey, hash[:], resp.ParsedTransaction.Signature)
if !valid {
return fmt.Errorf("invalid transaction signature")
}
return nil
}
func verifyPCRs(pcrs map[int][]byte) error {
// Load allowlist
allowlist := loadPCRAllowlist()
// Check each PCR
for idx, expected := range allowlist {
actual := hex.EncodeToString(pcrs[idx])
if actual != expected {
return fmt.Errorf("PCR%d mismatch: got %s, want %s",
idx, actual, expected)
}
}
return nil
}