search

confidential-containers / simple-kbs

Key Broker Server for SEV(-ES)
Apache License 2.0
10 stars 12 forks source link

About Launch_blob format #38

Closed shuk777 closed 1 year ago

shuk777 commented 1 year ago

Hi, there.

I was trying to write a kbs in Golang. However, when trying it with sev and Qemu I got a "bad measurement" error from sev. It seems that the SEV cannot validate the "WRAP_MAC" with my godh and launch_blob file. I tried to learn from your repo but I don't know much about Rust. So could you plz tell me your launch_blob format? Is it the same as the LAUNCH_START Session Data Buffer specified in SEV API specification(Table 45)? It's little endian or big endian formatted?

Best regards

fitzthum commented 1 year ago

Yeah the launch blob a.k.a. session file is basically just the TIK/TEK wrapped encrypted with the KEK and HMAC'd with the KIK. It is described in table 45. We use the virtee/sev crate to generate the launch blob. You can probably find more details there.