attest: Hash negotiation params, write evidence

Given the negotiation parameters from the proxy, SVSM can now hash the
parameters and embed them in the attestation evidence. It can also read
the negotiation key specified and create key accordingly.

As SEV-SNP is the only supported TEE architecture at the moment, there's
also a few changes required to serialize a SEV-SNP attestation report
into bytes.

Co-developed-by: Stefano Garzarella <[email protected]>
Signed-off-by: Tyler Fanelli <[email protected]>

Cargo.toml

@@ -48,6 +48,7 @@ userinit = { path = "user/init" }
 # crates.io
 aes-gcm = { version = "0.10.3", default-features = false }
 arbitrary = "1.3.0"
+base64 = { version = "0.22.1", default-features = false }
 bitfield-struct = "0.6.2"
 bitflags = "2.4"
 clap = { version = "4.4.14", default-features = false }
@@ -59,7 +60,9 @@ intrusive-collections = "0.9.6"
 kbs-types = { version = "0.9.2", default-features = false }
 libfuzzer-sys = "0.4"
 log = "0.4.17"
-p384 = { version = "0.13.0" }
+p384 = { version = "0.13.0", default-features = false }
+rand_chacha = { version = "0.3.1", default-features = false }
+rdrand = { version = "0.8.3", default-features = false }
 serde = { version = "1.0.215", default-features = false }
 serde_json = { version = "1.0", default-features = false }
 sha2 = { version = "0.10.8", default-features = false }

igvmmeasure/Cargo.toml

@@ -10,7 +10,7 @@ clap = { workspace = true, default-features = true, features = ["derive"] }
 sha2.workspace = true
 igvm.workspace = true
 igvm_defs.workspace = true
-p384.workspace = true
+p384 = { workspace = true, default-features = true }
 zerocopy.workspace = true
 # igvm_defs still uses 0.7, so we need to import the zerocopy 0.7 traits to use them.
 zerocopy07 = { package = "zerocopy", version = "0.7" }

kernel/Cargo.toml

@@ -26,6 +26,7 @@ elf.workspace = true
 syscall.workspace = true
 
 aes-gcm = { workspace = true, features = ["aes", "alloc"] }
+base64 = { workspace = true, optional = true, features = ["alloc"] }
 bitfield-struct.workspace = true
 bitflags.workspace = true
 gdbstub = { workspace = true, optional = true }
@@ -34,7 +35,10 @@ igvm_defs = { workspace = true, features = ["unstable"] }
 intrusive-collections.workspace = true
 kbs-types = { workspace = true, optional = true, features = ["alloc"] }
 log = { workspace = true, features = ["max_level_info", "release_max_level_info"] }
+p384 = { workspace = true, optional = true, features = ["alloc", "arithmetic", "ecdh", "jwk"] }
 packit.workspace = true
+rand_chacha = { workspace = true, optional = true }
+rdrand = { workspace = true, optional = true }
 libtcgtpm = { workspace = true, optional = true }
 serde = { workspace = true, optional = true, features = ["alloc", "derive"] }
 serde_json = { workspace = true, optional = true, features = ["alloc"] }
@@ -53,7 +57,9 @@ verify_external = { workspace = true, optional = true}
 test.workspace = true
 
 [features]
-attest = ["dep:kbs-types", "dep:libaproxy", "dep:serde", "dep:serde_json"]
+attest = ["dep:base64", "dep:kbs-types", "dep:libaproxy", "dep:p384",
+          "dep:rand_chacha", "dep:rdrand", "dep:serde", "dep:serde_json",
+          "dep:sha2"]
 default = []
 enable-gdb = ["dep:gdbstub", "dep:gdbstub_arch"]
 vtpm = ["dep:libtcgtpm"]