Closed raindust closed 2 years ago
PCRs 0,1,2 and 8 are always zeroed out when running in debug mode. PCRs 0-16 which are not in that list are reserved for future use by us. PCRs 16-32 are available for use by the enclave software post-boot. They become part of the attestation document once they are locked.
Thanks for your reply @petreeftime, have tested in normal mode and the PCR values worked properly.
PCRs 16-32 are available for use by the enclave software post-boot.
About the custom PCR value, is there any document or source code your can share with me? I read the AWS official document and some source code repos, but can not find any clue. Thanks.
Yes, there's an example in the tests in this repo: https://github.com/aws/aws-nitro-enclaves-nsm-api/blob/main/nsm-test/src/bin/nsm-check.rs#L193-L199.
Thanks, I will take a look
When I get attestation document by
nsm_get_attestation_doc
, and then decoded toAttestationDoc
and printpcrs
fields. Then print the results is the following:My question is:
Thanks