From 8ec11574344e19c10d5ba93a2e086aa279e528c1 Mon Sep 17 00:00:00 2001 From: Joy Wang <108701016+joyqvq@users.noreply.github.com> Date: Wed, 29 Jan 2025 15:09:22 -0500 Subject: [PATCH] update pcr getting method --- .../docs/sui/nitro_attestation.md | 185 +++++++++++++++--- .../sources/crypto/nitro_attestation.move | 63 ++++-- .../tests/crypto/nitro_attestation_test.move | 37 +++- .../packages_compiled/sui-framework | Bin 68111 -> 68346 bytes crates/sui-framework/published_api.txt | 14 +- crates/sui-protocol-config/src/lib.rs | 5 +- ...ocol_config__test__Mainnet_version_73.snap | 7 +- ...ocol_config__test__Testnet_version_73.snap | 7 +- ..._populated_genesis_snapshot_matches-2.snap | 29 +-- .../src/crypto/nitro_attestation.rs | 3 +- 10 files changed, 290 insertions(+), 60 deletions(-) diff --git a/crates/sui-framework/docs/sui/nitro_attestation.md b/crates/sui-framework/docs/sui/nitro_attestation.md index d17291dcd7247..efd9d9a204954 100644 --- a/crates/sui-framework/docs/sui/nitro_attestation.md +++ b/crates/sui-framework/docs/sui/nitro_attestation.md @@ -4,6 +4,7 @@ title: Module `sui::nitro_attestation` +- [Struct `PCREntry`](#sui_nitro_attestation_PCREntry) - [Struct `NitroAttestationDocument`](#sui_nitro_attestation_NitroAttestationDocument) - [Constants](#@Constants_0) - [Function `verify_nitro_attestation_internal`](#sui_nitro_attestation_verify_nitro_attestation_internal) @@ -11,10 +12,13 @@ title: Module `sui::nitro_attestation` - [Function `module_id`](#sui_nitro_attestation_module_id) - [Function `timestamp`](#sui_nitro_attestation_timestamp) - [Function `digest`](#sui_nitro_attestation_digest) -- [Function `get_pcrs`](#sui_nitro_attestation_get_pcrs) +- [Function `pcrs`](#sui_nitro_attestation_pcrs) - [Function `public_key`](#sui_nitro_attestation_public_key) - [Function `user_data`](#sui_nitro_attestation_user_data) - [Function `nonce`](#sui_nitro_attestation_nonce) +- [Function `version`](#sui_nitro_attestation_version) +- [Function `index`](#sui_nitro_attestation_index) +- [Function `value`](#sui_nitro_attestation_value) 
use std::ascii;
@@ -32,6 +36,38 @@ title: Module `sui::nitro_attestation`
 
 
 
+
+
+## Struct `PCREntry`
+
+Represents a PCR entry with an index and value.
+
+
+
public struct PCREntry has drop
+

+
+
+
+

+Fields
+
+
+

+

+index: u8
+

+

+

+

+value: vector<u8>
+

+

+

+

+
+
+

+
 
 
 ## Struct `NitroAttestationDocument`
@@ -39,7 +75,7 @@ title: Module `sui::nitro_attestation`
 Nitro Attestation Document defined for AWS.
 
 
-
public struct NitroAttestationDocument has copy, drop, store
+
public struct NitroAttestationDocument has drop
 

 
 
@@ -50,6 +86,12 @@ Nitro Attestation Document defined for AWS.
 
 

 

+version: u8
+

+

+ Version
+

+

 module_id: vector<u8>
 

 

@@ -68,7 +110,7 @@ Nitro Attestation Document defined for AWS.
  The digest function used for calculating the register values.
 

 

-pcrs: vector<vector<u8>>
+pcrs: vector<vector<u8>>
 

 

  The map of all locked PCRs at the moment the attestation document was generated.
@@ -104,6 +146,16 @@ Nitro Attestation Document defined for AWS.
 ## Constants
 
 
+
+
+Error that the pcrs length is invalid.
+
+
+
const EInvalidPcrLength: u64 = 3;
+

+
+
+
 
 
 Error that the feature is not available on this network.
@@ -116,7 +168,7 @@ Error that the feature is not available on this network.
 
 
 
-Error that the input failed to be parsed.
+Error that the attestation input failed to be parsed.
 
 
 
const EParseError: u64 = 1;
@@ -221,7 +273,7 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 
 
 
-
public fun timestamp(attestation: &sui::nitro_attestation::NitroAttestationDocument): u64
+
public fun timestamp(attestation: &sui::nitro_attestation::NitroAttestationDocument): &u64
 

 
 
@@ -230,8 +282,8 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 Implementation
 
 
-
public fun timestamp(attestation: &NitroAttestationDocument): u64 {
-    attestation.timestamp
+
public fun timestamp(attestation: &NitroAttestationDocument): &u64 {
+    &attestation.timestamp
 }
 

 
@@ -245,7 +297,7 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 
 
 
-
public fun digest(attestation: &sui::nitro_attestation::NitroAttestationDocument): vector<u8>
+
public fun digest(attestation: &sui::nitro_attestation::NitroAttestationDocument): &vector<u8>
 

 
 
@@ -254,8 +306,8 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 Implementation
 
 
-
public fun digest(attestation: &NitroAttestationDocument): vector<u8> {
-    attestation.digest
+
public fun digest(attestation: &NitroAttestationDocument): &vector<u8> {
+    &attestation.digest
 }
 

 
@@ -263,13 +315,15 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 
 
 
-
+
 
-## Function `get_pcrs`
+## Function `pcrs`
 
+Returns a list of mapping from index to the pcr itself. Currently AWS supports
+PCR0, PCR1, PCR2, PCR3, PCR4, PCR8.
 
 
-
public fun get_pcrs(attestation: &sui::nitro_attestation::NitroAttestationDocument): vector<vector<u8>>
+
public fun pcrs(attestation: &sui::nitro_attestation::NitroAttestationDocument): vector<sui::nitro_attestation::PCREntry>
 

 
 
@@ -278,8 +332,19 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 Implementation
 
 
-
public fun get_pcrs(attestation: &NitroAttestationDocument): vector<vector<u8>> {
-    attestation.pcrs
+
public fun pcrs(attestation: &NitroAttestationDocument): vector<PCREntry> {
+    assert!(attestation.pcrs.length() == 6, EInvalidPcrLength);
+    let mut result: vector<PCREntry> = vector::empty();
+    let indices = vector[0, 1, 2, 3, 4, 8];
+    let mut i = 0;
+    while (i < attestation.pcrs.length()) {
+        result.push_back(PCREntry {
+            index: indices[i],
+            value: attestation.pcrs[i]
+        });
+        i = i + 1;
+    };
+    result
 }
 

 
@@ -293,7 +358,7 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 
 
 
-
public fun public_key(attestation: &sui::nitro_attestation::NitroAttestationDocument): std::option::Option<vector<u8>>
+
public fun public_key(attestation: &sui::nitro_attestation::NitroAttestationDocument): &std::option::Option<vector<u8>>
 

 
 
@@ -302,8 +367,8 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 Implementation
 
 
-
public fun public_key(attestation: &NitroAttestationDocument): Option<vector<u8>> {
-    attestation.public_key
+
public fun public_key(attestation: &NitroAttestationDocument): &Option<vector<u8>> {
+    &attestation.public_key
 }
 

 
@@ -317,7 +382,7 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 
 
 
-
public fun user_data(attestation: &sui::nitro_attestation::NitroAttestationDocument): std::option::Option<vector<u8>>
+
public fun user_data(attestation: &sui::nitro_attestation::NitroAttestationDocument): &std::option::Option<vector<u8>>
 

 
 
@@ -326,8 +391,8 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 Implementation
 
 
-
public fun user_data(attestation: &NitroAttestationDocument): Option<vector<u8>> {
-    attestation.user_data
+
public fun user_data(attestation: &NitroAttestationDocument): &Option<vector<u8>> {
+    &attestation.user_data
 }
 

 
@@ -341,7 +406,79 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 
 
 
-
public fun nonce(attestation: &sui::nitro_attestation::NitroAttestationDocument): std::option::Option<vector<u8>>
+
public fun nonce(attestation: &sui::nitro_attestation::NitroAttestationDocument): &std::option::Option<vector<u8>>
+

+
+
+
+

+Implementation
+
+
+
public fun nonce(attestation: &NitroAttestationDocument): &Option<vector<u8>> {
+    &attestation.nonce
+}
+

+
+
+
+

+
+
+
+## Function `version`
+
+
+
+
public fun version(attestation: &sui::nitro_attestation::NitroAttestationDocument): &u8
+

+
+
+
+

+Implementation
+
+
+
public fun version(attestation: &NitroAttestationDocument): &u8 {
+    &attestation.version
+}
+

+
+
+
+

+
+
+
+## Function `index`
+
+
+
+
public fun index(entry: &sui::nitro_attestation::PCREntry): u8
+

+
+
+
+

+Implementation
+
+
+
public fun index(entry: &PCREntry): u8 {
+    entry.index
+}
+

+
+
+
+

+
+
+
+## Function `value`
+
+
+
+
public fun value(entry: &sui::nitro_attestation::PCREntry): &vector<u8>
 

 
 
@@ -350,8 +487,8 @@ Returns parsed NitroAttestationDocument after verifying the attestation.
 Implementation
 
 
-
public fun nonce(attestation: &NitroAttestationDocument): Option<vector<u8>> {
-    attestation.nonce
+
public fun value(entry: &PCREntry): &vector<u8> {
+    &entry.value
 }
 

 
diff --git a/crates/sui-framework/packages/sui-framework/sources/crypto/nitro_attestation.move b/crates/sui-framework/packages/sui-framework/sources/crypto/nitro_attestation.move
index d98b0b1d1ec56..79bf1d340ca45 100644
--- a/crates/sui-framework/packages/sui-framework/sources/crypto/nitro_attestation.move
+++ b/crates/sui-framework/packages/sui-framework/sources/crypto/nitro_attestation.move
@@ -9,15 +9,25 @@ use sui::clock::{Self, Clock};
 /// Error that the feature is not available on this network.
 const ENotSupportedError: u64 = 0;
 #[allow(unused_const)]
-/// Error that the input failed to be parsed. 
+/// Error that the attestation input failed to be parsed. 
 const EParseError: u64 = 1;
 #[allow(unused_const)]
 /// Error that the attestation failed to be verified. 
 const EVerifyError: u64 = 2;
+#[allow(unused_const)]
+/// Error that the pcrs length is invalid. 
+const EInvalidPcrLength: u64 = 3;
 
+/// Represents a PCR entry with an index and value.
+public struct PCREntry has drop {
+    index: u8,
+    value: vector
+}
 
 /// Nitro Attestation Document defined for AWS.
-public struct NitroAttestationDocument has store, copy, drop  {
+public struct NitroAttestationDocument has drop  {
+    /// Version
+    version: u8,
     /// Issuing Nitro hypervisor module ID.
     module_id: vector,
     /// UTC time when document was created, in milliseconds since UNIX epoch.
@@ -54,30 +64,55 @@ public fun verify_nitro_attestation(
     verify_nitro_attestation_internal(attestation, clock::timestamp_ms(clock))
 }
 
+public fun version(attestation: &NitroAttestationDocument): &u8 {
+    &attestation.version
+}
+
 public fun module_id(attestation: &NitroAttestationDocument): vector {
     attestation.module_id
 }
 
-public fun timestamp(attestation: &NitroAttestationDocument): u64 {
-    attestation.timestamp
+public fun timestamp(attestation: &NitroAttestationDocument): &u64 {
+    &attestation.timestamp
+}
+
+public fun digest(attestation: &NitroAttestationDocument): &vector {
+    &attestation.digest
+}
+
+/// Returns a list of mapping from index to the pcr itself. Currently AWS supports 
+///PCR0, PCR1, PCR2, PCR3, PCR4, PCR8. 
+public fun pcrs(attestation: &NitroAttestationDocument): vector {
+    assert!(attestation.pcrs.length() == 6, EInvalidPcrLength);
+    let mut result: vector = vector::empty();
+    let indices = vector[0, 1, 2, 3, 4, 8];
+    let mut i = 0;
+    while (i < attestation.pcrs.length()) {
+        result.push_back(PCREntry {
+            index: indices[i],
+            value: attestation.pcrs[i]
+        });
+        i = i + 1;
+    };
+    result
 }
 
-public fun digest(attestation: &NitroAttestationDocument): vector {
-    attestation.digest
+public fun public_key(attestation: &NitroAttestationDocument): &Option> {
+    &attestation.public_key
 }
 
-public fun get_pcrs(attestation: &NitroAttestationDocument): vector> {
-    attestation.pcrs
+public fun user_data(attestation: &NitroAttestationDocument): &Option> {
+    &attestation.user_data
 }
 
-public fun public_key(attestation: &NitroAttestationDocument): Option> {
-    attestation.public_key
+public fun nonce(attestation: &NitroAttestationDocument): &Option> {
+    &attestation.nonce
 }
 
-public fun user_data(attestation: &NitroAttestationDocument): Option> {
-    attestation.user_data
+public fun index(entry: &PCREntry): u8 {
+    entry.index
 }
 
-public fun nonce(attestation: &NitroAttestationDocument): Option> {
-    attestation.nonce
+public fun value(entry: &PCREntry): &vector {
+    &entry.value
 }
diff --git a/crates/sui-framework/packages/sui-framework/tests/crypto/nitro_attestation_test.move b/crates/sui-framework/packages/sui-framework/tests/crypto/nitro_attestation_test.move
index 66599b632bf5d..e6665e9ebf465 100644
--- a/crates/sui-framework/packages/sui-framework/tests/crypto/nitro_attestation_test.move
+++ b/crates/sui-framework/packages/sui-framework/tests/crypto/nitro_attestation_test.move
@@ -15,11 +15,46 @@ module sui::nitro_attestation_tests {
         clock.set_for_testing(1731627987382);
         let res = nitro_attestation::verify_nitro_attestation(&payload, &clock);
         
-        assert!(vector::length(&nitro_attestation::get_pcrs(&res)) == 6);
+        assert!(res.pcrs().length() == 6);
+
+        assert!(res.pcrs()[0].index() == 0);
+        assert!(res.pcrs()[1].index() == 1);
+        assert!(res.pcrs()[2].index() == 2);
+        assert!(res.pcrs()[3].index() == 3);
+        assert!(res.pcrs()[4].index() == 4);
+        assert!(res.pcrs()[5].index() == 8);
+
         assert!(res.user_data().is_some());
         assert!(res.nonce().is_none());
         assert!(res.public_key().is_none());
+        assert!(res.version() == 0);
+        scenario.end();
+        clock.destroy_for_testing();
+    }
 
+    #[test]
+    #[expected_failure(abort_code = nitro_attestation::EParseError)]
+    fun test_nitro_attestation_invalid_attestation() {
+        let mut scenario = test_scenario::begin(@0x0);
+        let ctx = scenario.ctx();
+        let mut clock = sui::clock::create_for_testing(ctx);
+        clock.set_for_testing(1731627987382);
+        let payload = x"0000";
+        nitro_attestation::verify_nitro_attestation(&payload, &clock);
+        scenario.end();
+        clock.destroy_for_testing();
+    }
+
+    #[test]
+    #[expected_failure(abort_code = nitro_attestation::EVerifyError)]
+    fun test_nitro_attestation_expired() {
+        let mut scenario = test_scenario::begin(@0x0);
+        let ctx = scenario.ctx();
+        let payload = x"8444a1013822a0591121a9696d6f64756c655f69647827692d30663733613462346362373463633966322d656e633031393265343138386665663738316466646967657374665348413338346974696d657374616d701b000001932d1239ca6470637273b0005830000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000015830000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025830000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000035830639a8b65f68b0223cbb14a0032487e5656d260434e3d1a10e7ec1407fb86143860717fc8afee90df7a1604111709af460458309ab5a1aba055ee41ee254b9b251a58259b29fa1096859762744e9ac73b5869b25e51223854d9f86adbb37fe69f3e5d1c0558300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000658300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000758300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000858300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000958300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a58300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b58300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c58300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d58300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e58300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f58300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006b636572746966696361746559027e3082027a30820201a00302010202100192e4188fef781d0000000067366a8d300a06082a8648ce3d04030330818e310b30090603550406130255533113301106035504080c0a57617368696e67746f6e3110300e06035504070c0753656174746c65310f300d060355040a0c06416d617a6f6e310c300a060355040b0c034157533139303706035504030c30692d30663733613462346362373463633966322e75732d656173742d312e6177732e6e6974726f2d656e636c61766573301e170d3234313131343231323432365a170d3234313131353030323432395a308193310b30090603550406130255533113301106035504080c0a57617368696e67746f6e3110300e06035504070c0753656174746c65310f300d060355040a0c06416d617a6f6e310c300a060355040b0c03415753313e303c06035504030c35692d30663733613462346362373463633966322d656e63303139326534313838666566373831642e75732d656173742d312e6177733076301006072a8648ce3d020106052b810400220362000442e0526fc41af71feac64fc6f68a8ac8aae831a9e945ab7d482b842acaf05d6b762d00cbc2115da270187c44597b1c16dcf497c70e543b41612e9041ea143d11d58bd1c847496e5d41ec78a49fe445348cf9a47af9387e0451d9ec145b56ec12a31d301b300c0603551d130101ff04023000300b0603551d0f0404030206c0300a06082a8648ce3d0403030367003064023078001466c0c64293b9bde3d0834edb67ff18417f6075a8f7d137701e10164ce6cf45c508bf383ed0d8d41c51a5977a43023033cb8e4a6ad2686b86c2533accbab5dd5e98cf25d3612b1a48502f327ce00acc921641242d5a3a27d222df1f7dfc3e2c68636162756e646c65845902153082021130820196a003020102021100f93175681b90afe11d46ccb4e4e7f856300a06082a8648ce3d0403033049310b3009060355040613025553310f300d060355040a0c06416d617a6f6e310c300a060355040b0c03415753311b301906035504030c126177732e6e6974726f2d656e636c61766573301e170d3139313032383133323830355a170d3439313032383134323830355a3049310b3009060355040613025553310f300d060355040a0c06416d617a6f6e310c300a060355040b0c03415753311b301906035504030c126177732e6e6974726f2d656e636c617665733076301006072a8648ce3d020106052b8104002203620004fc0254eba608c1f36870e29ada90be46383292736e894bfff672d989444b5051e534a4b1f6dbe3c0bc581a32b7b176070ede12d69a3fea211b66e752cf7dd1dd095f6f1370f4170843d9dc100121e4cf63012809664487c9796284304dc53ff4a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604149025b50dd90547e796c396fa729dcf99a9df4b96300e0603551d0f0101ff040403020186300a06082a8648ce3d0403030369003066023100a37f2f91a1c9bd5ee7b8627c1698d255038e1f0343f95b63a9628c3d39809545a11ebcbf2e3b55d8aeee71b4c3d6adf3023100a2f39b1605b27028a5dd4ba069b5016e65b4fbde8fe0061d6a53197f9cdaf5d943bc61fc2beb03cb6fee8d2302f3dff65902c2308202be30820245a003020102021100ab314210a819b4842e3be045e7daddbe300a06082a8648ce3d0403033049310b3009060355040613025553310f300d060355040a0c06416d617a6f6e310c300a060355040b0c03415753311b301906035504030c126177732e6e6974726f2d656e636c61766573301e170d3234313131333037333235355a170d3234313230333038333235355a3064310b3009060355040613025553310f300d060355040a0c06416d617a6f6e310c300a060355040b0c034157533136303406035504030c2d343834633637303131656563376235332e75732d656173742d312e6177732e6e6974726f2d656e636c617665733076301006072a8648ce3d020106052b8104002203620004cbd3e3fe8793852d952a214ee1c7f17e13eff238c5952ffc6c48f2b8e70beec10194585089829f4818d012a6061cdc9f4d8c5a67aada1233f75b65d3f7704e1c02460cfcc74f0e94193c8d4030f6d1662de0427836c1d32c571c919230fae73aa381d53081d230120603551d130101ff040830060101ff020102301f0603551d230418301680149025b50dd90547e796c396fa729dcf99a9df4b96301d0603551d0e04160414b5f0f617140aa7057c7977f361eee896fd9a58b4300e0603551d0f0101ff040403020186306c0603551d1f046530633061a05fa05d865b687474703a2f2f6177732d6e6974726f2d656e636c617665732d63726c2e73332e616d617a6f6e6177732e636f6d2f63726c2f61623439363063632d376436332d343262642d396539662d3539333338636236376638342e63726c300a06082a8648ce3d04030303670030640230038362cf11e189755d6a2306d728a7f356740eefe623d5e0e9e7c33c1b061ade2224127ac3a2e4bce60b43fc8c53326902306aceccf6f45a8d5c066bd10ce3ffaeeebdee56eedb86deb18ea22172c07196750924dd8f4656c70bd95eb6714cb8ecdd59031a308203163082029ba0030201020211009a0f4f29c1649826edb5b5f9f93b6326300a06082a8648ce3d0403033064310b3009060355040613025553310f300d060355040a0c06416d617a6f6e310c300a060355040b0c034157533136303406035504030c2d343834633637303131656563376235332e75732d656173742d312e6177732e6e6974726f2d656e636c61766573301e170d3234313131343034323230325a170d3234313132303033323230325a308189313c303a06035504030c33373532313933346262636164353432622e7a6f6e616c2e75732d656173742d312e6177732e6e6974726f2d656e636c61766573310c300a060355040b0c03415753310f300d060355040a0c06416d617a6f6e310b3009060355040613025553310b300906035504080c0257413110300e06035504070c0753656174746c653076301006072a8648ce3d020106052b810400220362000496f4565c489625767e8e2d3006ba06bd48ba3e384027a205b93d1ad4958128887c38ddbb2f4922888708ef0985e1e5d3bd73b33f86785ac66a204eed3a6b663686434f64e19fb39cd7b33068edb2108b79774a961e7080cb1b4eaa60a5e63e22a381ea3081e730120603551d130101ff040830060101ff020101301f0603551d23041830168014b5f0f617140aa7057c7977f361eee896fd9a58b4301d0603551d0e0416041484b6dc9994365b56081f5d1bc8ee21f58e45d7df300e0603551d0f0101ff0404030201863081800603551d1f047930773075a073a071866f687474703a2f2f63726c2d75732d656173742d312d6177732d6e6974726f2d656e636c617665732e73332e75732d656173742d312e616d617a6f6e6177732e636f6d2f63726c2f34396230376261342d303533622d346435622d616434612d3364626533653065396637652e63726c300a06082a8648ce3d0403030369003066023100d00c2999e66fbcce624d91aedf41f5532b04c300c86a61d78ed968716a7f7ff565e2c361f4f46fe5c5486a9d2bfe0d60023100bc46872a45820fb552b926d420d4f6a1be831bb26821d374e95bff5ed042b3313465b5b4cde79f16f6a57bd5b541353c5902c3308202bf30820245a003020102021500eaa3f0b662c2a61c96f94194fa33d5baf26eeb84300a06082a8648ce3d040303308189313c303a06035504030c33373532313933346262636164353432622e7a6f6e616c2e75732d656173742d312e6177732e6e6974726f2d656e636c61766573310c300a060355040b0c03415753310f300d060355040a0c06416d617a6f6e310b3009060355040613025553310b300906035504080c0257413110300e06035504070c0753656174746c65301e170d3234313131343130313032345a170d3234313131353130313032345a30818e310b30090603550406130255533113301106035504080c0a57617368696e67746f6e3110300e06035504070c0753656174746c65310f300d060355040a0c06416d617a6f6e310c300a060355040b0c034157533139303706035504030c30692d30663733613462346362373463633966322e75732d656173742d312e6177732e6e6974726f2d656e636c617665733076301006072a8648ce3d020106052b81040022036200040fe46adf864a558a00a9ca4b64ece5ba124ed1d29656a1f16ca71d0dc8fca56b0fb15aafd309f6258374e8c7b4a5b0521c76d1812a7873474dae9322aef1cd782db19fc2ece4d36fa08acbe65e4bec2a3cfe70960d179778ea7e7711f827b36ea366306430120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e041604143e40d423bf86e9565c378487843389bd2f471a56301f0603551d2304183016801484b6dc9994365b56081f5d1bc8ee21f58e45d7df300a06082a8648ce3d0403030368003065023100c2767f29cc6e40e087617cf680d81e3b77962c29d8ace426b3c4a62a560354da73de6f80986d44da2593a3c268fea94302306056e2f3c88c30170c4940f578acc279a01fe689123e81def4f8c313e1f0cbc44a562a171d12810e847e441aee233f676a7075626c69635f6b6579f669757365725f6461746158205a264748a62368075d34b9494634a3e096e0e48f6647f965b81d2a653de684f2656e6f6e6365f65860284d57f029e1b3beb76455a607b9a86360d6451370f718a0d7bdcad729eea248c25461166ab684ad31fb52713918ee3e401d1b56251d6f9d85bf870e850e0b47559d17091778dbafc3d1989a94bd54c0991053675dcc3686402b189172aae196";
+        let mut clock = sui::clock::create_for_testing(ctx);
+        clock.set_for_testing(1731627987382 + 3 * 60 * 60 * 1000);
+        nitro_attestation::verify_nitro_attestation(&payload, &clock);
+    
         scenario.end();
         clock.destroy_for_testing();
     }
diff --git a/crates/sui-framework/packages_compiled/sui-framework b/crates/sui-framework/packages_compiled/sui-framework
index ec3ce2ea1fa36335003c838d80eafb2ae0446050..16851ae609ff82c6866dcc8609f06f92969f8faf 100644
GIT binary patch
delta 591
zcmXw1O>0y!6g~IetRh`
z4
zC1mynM;8+s*>qa&zKr>47ktj3Am=xle_TlpuI6P7YD#wfCGV_T8_19oZRNHw23$MA
zwI-8V`F@H)}p+-eSt4;
IP7bg91rLul761SM

delta 367
zcmXw#u}VWh5Jm6I?C#s_CQk#4HY(a^D^@}vSosk)7BK`-QA|oPpOE5dC!*j72-aGq
zPxK4y{R0tk^5Sdm9tQU8o&CNwqZ{+QJsEzQ$Ca<>00e?#mrL5Q`&-%BJNY->bHBV6
z?qs9>D!s;&$&pbF0?I&~5y0@kB9s;emUJy!!e
z&*VHPFbM_CNXpO|7eABDCEGbY@0_@!<6gHv@V)Nf@S=0sFWS?C;(ppH#^d$kVbmUi
zGqu*m1P*G6r6n)Z&y8A^w4=8Xk(#w8cvjh)s0$?R^UsvnRLqHO#gf=nY*M*>dDkZP
Xgyp%&CDyMbeM(?p;a;vju6O?c#fB-c

diff --git a/crates/sui-framework/published_api.txt b/crates/sui-framework/published_api.txt
index 89bbd233212de..b09bc368d040c 100644
--- a/crates/sui-framework/published_api.txt
+++ b/crates/sui-framework/published_api.txt
@@ -2788,6 +2788,9 @@ sqrt_u128
 divide_and_round_up
 	public fun
 	0x2::math
+PCREntry
+	public struct
+	0x2::nitro_attestation
 NitroAttestationDocument
 	public struct
 	0x2::nitro_attestation
@@ -2806,7 +2809,7 @@ timestamp
 digest
 	public fun
 	0x2::nitro_attestation
-get_pcrs
+pcrs
 	public fun
 	0x2::nitro_attestation
 public_key
@@ -2818,6 +2821,15 @@ user_data
 nonce
 	public fun
 	0x2::nitro_attestation
+version
+	public fun
+	0x2::nitro_attestation
+index
+	public fun
+	0x2::nitro_attestation
+value
+	public fun
+	0x2::nitro_attestation
 ObjectBag
 	public struct
 	0x2::object_bag
diff --git a/crates/sui-protocol-config/src/lib.rs b/crates/sui-protocol-config/src/lib.rs
index 6acd66b194b6e..3394f9e216fed 100644
--- a/crates/sui-protocol-config/src/lib.rs
+++ b/crates/sui-protocol-config/src/lib.rs
@@ -1792,13 +1792,12 @@ impl ProtocolConfig {
         self.feature_flags.variant_nodes
     }
 
-<<<<<<< HEAD
     pub fn consensus_zstd_compression(&self) -> bool {
         self.feature_flags.consensus_zstd_compression
-=======
+    }
+
     pub fn enable_nitro_attestation(&self) -> bool {
         self.feature_flags.enable_nitro_attestation
->>>>>>> 2d97ead085 (feat: add move entry function)
     }
 }
 
diff --git a/crates/sui-protocol-config/src/snapshots/sui_protocol_config__test__Mainnet_version_73.snap b/crates/sui-protocol-config/src/snapshots/sui_protocol_config__test__Mainnet_version_73.snap
index 73826f83ff7dc..e83b910a31737 100644
--- a/crates/sui-protocol-config/src/snapshots/sui_protocol_config__test__Mainnet_version_73.snap
+++ b/crates/sui-protocol-config/src/snapshots/sui_protocol_config__test__Mainnet_version_73.snap
@@ -1,6 +1,7 @@
 ---
 source: crates/sui-protocol-config/src/lib.rs
 expression: "ProtocolConfig::get_for_version(cur, *chain_id)"
+snapshot_kind: text
 ---
 version: 73
 feature_flags:
@@ -288,6 +289,10 @@ hmac_hmac_sha3_256_input_cost_per_byte: 2
 hmac_hmac_sha3_256_input_cost_per_block: 2
 check_zklogin_id_cost_base: 200
 check_zklogin_issuer_cost_base: 200
+nitro_attestation_parse_base_cost: 53
+nitro_attestation_parse_cost_per_byte: 1
+nitro_attestation_verify_base_cost: 49632
+nitro_attestation_verify_cost_per_cert: 52369
 bcs_per_byte_serialized_cost: 2
 bcs_legacy_min_output_size_cost: 1
 bcs_failure_cost: 52
@@ -343,4 +348,4 @@ max_accumulated_randomness_txn_cost_per_object_in_mysticeti_commit: 3700000
 gas_budget_based_txn_cost_cap_factor: 400000
 gas_budget_based_txn_cost_absolute_cap_commit_count: 50
 sip_45_consensus_amplification_threshold: 5
-use_object_per_epoch_marker_table_v2: true
\ No newline at end of file
+use_object_per_epoch_marker_table_v2: true
diff --git a/crates/sui-protocol-config/src/snapshots/sui_protocol_config__test__Testnet_version_73.snap b/crates/sui-protocol-config/src/snapshots/sui_protocol_config__test__Testnet_version_73.snap
index 9bd4325e1d2df..e9ca3cdd53392 100644
--- a/crates/sui-protocol-config/src/snapshots/sui_protocol_config__test__Testnet_version_73.snap
+++ b/crates/sui-protocol-config/src/snapshots/sui_protocol_config__test__Testnet_version_73.snap
@@ -1,6 +1,7 @@
 ---
 source: crates/sui-protocol-config/src/lib.rs
 expression: "ProtocolConfig::get_for_version(cur, *chain_id)"
+snapshot_kind: text
 ---
 version: 73
 feature_flags:
@@ -292,6 +293,10 @@ hmac_hmac_sha3_256_input_cost_per_byte: 2
 hmac_hmac_sha3_256_input_cost_per_block: 2
 check_zklogin_id_cost_base: 200
 check_zklogin_issuer_cost_base: 200
+nitro_attestation_parse_base_cost: 53
+nitro_attestation_parse_cost_per_byte: 1
+nitro_attestation_verify_base_cost: 49632
+nitro_attestation_verify_cost_per_cert: 52369
 bcs_per_byte_serialized_cost: 2
 bcs_legacy_min_output_size_cost: 1
 bcs_failure_cost: 52
@@ -347,4 +352,4 @@ max_accumulated_randomness_txn_cost_per_object_in_mysticeti_commit: 3700000
 gas_budget_based_txn_cost_cap_factor: 400000
 gas_budget_based_txn_cost_absolute_cap_commit_count: 50
 sip_45_consensus_amplification_threshold: 5
-use_object_per_epoch_marker_table_v2: true
\ No newline at end of file
+use_object_per_epoch_marker_table_v2: true
diff --git a/crates/sui-swarm-config/tests/snapshots/snapshot_tests__populated_genesis_snapshot_matches-2.snap b/crates/sui-swarm-config/tests/snapshots/snapshot_tests__populated_genesis_snapshot_matches-2.snap
index 8bc58b1613aac..9df4e396f5f7b 100644
--- a/crates/sui-swarm-config/tests/snapshots/snapshot_tests__populated_genesis_snapshot_matches-2.snap
+++ b/crates/sui-swarm-config/tests/snapshots/snapshot_tests__populated_genesis_snapshot_matches-2.snap
@@ -1,6 +1,7 @@
 ---
 source: crates/sui-swarm-config/tests/snapshot_tests.rs
 expression: genesis.sui_system_object().into_genesis_version_for_tooling()
+snapshot_kind: text
 ---
 epoch: 0
 protocol_version: 73
@@ -240,13 +241,13 @@ validators:
         next_epoch_worker_address: ~
         extra_fields:
           id:
-            id: "0xdbdba59e8d3ba41022bab14be40d8f7e94ce34e81b3f72f54cc042e08596de4c"
+            id: "0xe6b2d49d9a5bbc0d69c08c1bb09bd6a8cbc4f0267b3433c9424d72ee5f4030ed"
           size: 0
       voting_power: 10000
-      operation_cap_id: "0x781fbd690374cf8762ad4267e38491facbd97e4107c24e0d45f3fdb86b1dfbf9"
+      operation_cap_id: "0xcc6a9404d5856311141d8e412f24e76888f7ca8e6d4726cc76849d04ee8d5b0b"
       gas_price: 1000
       staking_pool:
-        id: "0x64879d7f58f14af97b04e9efdf42b4f22871095cab0c8419c407166e6e77876b"
+        id: "0x16c56658e4959a30c7e67f40da8f81d700a8fb7b4e8adc812fce94821a756709"
         activation_epoch: 0
         deactivation_epoch: ~
         sui_balance: 20000000000000000
@@ -254,14 +255,14 @@ validators:
           value: 0
         pool_token_balance: 20000000000000000
         exchange_rates:
-          id: "0x4efb422304b687dd0fc6302a8035b748fad7addc6fbb92445621f30126af6399"
+          id: "0xeca474aa14ba57ab4d1f4ec26dd72400a6584e13cf7adf4b73e5c93d19240828"
           size: 1
         pending_stake: 0
         pending_total_sui_withdraw: 0
         pending_pool_token_withdraw: 0
         extra_fields:
           id:
-            id: "0xfc83b25dbdafc203467cca7e051fa4bbd100e57b7f03e0cd87911df132c4666f"
+            id: "0xd67fa58e04e1a49fd0c73d205b1ef15b2590f5d6ffa36dc3086191568480f24d"
           size: 0
       commission_rate: 200
       next_epoch_stake: 20000000000000000
@@ -269,27 +270,27 @@ validators:
       next_epoch_commission_rate: 200
       extra_fields:
         id:
-          id: "0x596e3e1b0062e1e25724f1513e525180f3322caf0f4ed7357e6d0d91e5485f8d"
+          id: "0x1b1b905046e39a40336fd5d4c524ffff10e1c3dcbe02a8359ef40ada983bbb28"
         size: 0
   pending_active_validators:
     contents:
-      id: "0xdca07b56eafc8888156cc270f74a1537a2feabd6349eb7322d0597d7a1416855"
+      id: "0xbe827c97b623466b4c45bf2ba408ed062700abbd0163bb94f8be900ad6fc40bf"
       size: 0
   pending_removals: []
   staking_pool_mappings:
-    id: "0xfe67f005cc7aa7ee31c7c00515bb7688e0a26c4212c0d0f916adffd3102b1224"
+    id: "0x72c65919b3f40f189bdb9bdc12f156a2f1b3caebd78a7a35dc81817e24d585b9"
     size: 1
   inactive_validators:
-    id: "0x9b5c54aaee4d86f5e7d90e6d59663f5d7c3e35b6d753c8d4e1262e5aa481995e"
+    id: "0x712a764b06284ff1d7c74d32d92b254ae72bdced6ae76f7643abf85c717b677e"
     size: 0
   validator_candidates:
-    id: "0xd326ffe2ded7f03b1e6258136ef11cd327450c9e2d4082f0a036a55462a46f87"
+    id: "0x709ccefe0f1c7daa3d46a895ac8dcd82ab9998c3642107b0ea0eaa5d502b933a"
     size: 0
   at_risk_validators:
     contents: []
   extra_fields:
     id:
-      id: "0xc5c7d9d06409741f9b76c451110c8fe01a3ce83dbf8112bbbc0698f3bcba7fdf"
+      id: "0xabea8b75c4e0823db9fd71aeae2324952d2e21b8a770799c1d03f2fe94a938d2"
     size: 0
 storage_fund:
   total_object_storage_rebates:
@@ -306,7 +307,7 @@ parameters:
   validator_low_stake_grace_period: 7
   extra_fields:
     id:
-      id: "0x3f9233a9367aa555a386b7719ffb0b95453ea1637b000374406bcbd5c7cd1ab8"
+      id: "0xc0b705806272391f80bd59ca03942d4fee839fe28fe88eaf670030fa6dd344dc"
     size: 0
 reference_gas_price: 1000
 validator_report_records:
@@ -320,7 +321,7 @@ stake_subsidy:
   stake_subsidy_decrease_rate: 1000
   extra_fields:
     id:
-      id: "0x6adc3330fd576aa8deab8d211551a89839a0f6bb0b069fb5e1fa58e5f7ada727"
+      id: "0x0eb0849b6cad0d3267add9c489b561ccc074139b5275a118d085853c6ce14e80"
     size: 0
 safe_mode: false
 safe_mode_storage_rewards:
@@ -332,5 +333,5 @@ safe_mode_non_refundable_storage_fee: 0
 epoch_start_timestamp_ms: 10
 extra_fields:
   id:
-    id: "0x3b76d97d377057fd076a1845f461b04223bc145c548c5a357dd6ad4097cabb85"
+    id: "0x5a16cc38b9d9cc7aba4b69bd8fa10014b38532590fed0f78c69907af6a1bceb8"
   size: 0
diff --git a/sui-execution/latest/sui-move-natives/src/crypto/nitro_attestation.rs b/sui-execution/latest/sui-move-natives/src/crypto/nitro_attestation.rs
index 1041de8a630cb..437a000afb8e6 100644
--- a/sui-execution/latest/sui-move-natives/src/crypto/nitro_attestation.rs
+++ b/sui-execution/latest/sui-move-natives/src/crypto/nitro_attestation.rs
@@ -19,8 +19,8 @@ use move_vm_runtime::native_charge_gas_early_exit;
 pub const NOT_SUPPORTED_ERROR: u64 = 0;
 pub const PARSE_ERROR: u64 = 1;
 pub const VERIFY_ERROR: u64 = 2;
-// Gas related structs and functions.
 
+// Gas related structs and functions.
 #[derive(Clone)]
 pub struct NitroAttestationCostParams {
     pub parse_base_cost: Option,
@@ -98,6 +98,7 @@ pub fn verify_nitro_attestation_internal(
                     // Could do this with `and_then` as well if desired.
                     let result = || {
                         Ok(Value::struct_(Struct::pack(vec![
+                            Value::u8(0), // Starts from 0
                             Value::vector_u8(payload.module_id.as_bytes().to_vec()),
                             Value::u64(payload.timestamp),
                             Value::vector_u8(payload.digest.as_bytes().to_vec()),